{"id":"CVE-2026-50641","aliases":["EUVD-2026-50306","GHSA-v8g3-5gq5-j8gw"],"status":"published","title":"Plaintext password storage in Streamsoft Business Intelligence","description":"Streamsoft Business Intelligence (BI) stores users' passwords in plaintext form in the database\n\nThis issue was fixed in version 6.8.0.0, users were also requested to change their password on the first login.","severity":{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00238,"percentile":0.14873,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-256"],"published":"2026-07-29T12:37:58Z","modified":"2026-10-23T23:10:00Z","products":[{"vendor":"oracle","product":"business intelligence"},{"vendor":"streamsoft","product":"business intelligence"}],"references":[{"url":"https://cert.pl/posts/2026/07/CVE-2026-50641","tags":["third-party-advisory"]},{"url":"https://www.streamsoft.pl/business-intelligence/","tags":["product"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50641"},{"url":"https://www.streamsoft.pl/business-intelligence"},{"url":"https://github.com/advisories/GHSA-v8g3-5gq5-j8gw"}],"sources":{"cve":[{"id":"CVE-2026-50641","title":"Plaintext password storage in Streamsoft Business Intelligence","description":"Streamsoft Business Intelligence (BI) stores users' passwords in plaintext form in the database\n\nThis issue was fixed in version 6.8.0.0, users were also requested to change their password on the first login.","status":"published","published":"2026-07-29T12:37:58.532Z","modified":"2026-07-29T14:18:45.698Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-256"],"updated_at":"2026-11-02T14:20:09.098623Z"}],"euvd":[{"id":"EUVD-2026-50306","description":"Streamsoft Business Intelligence (BI) stores users' passwords in plaintext form in the database\n\nThis issue was fixed in version 6.8.0.0, users were also requested to change their password on the first login.","status":"published","published":"2026-07-29T12:37:58Z","modified":"2026-07-29T14:18:45Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:02:30.152277Z"}],"ghsa":[{"id":"GHSA-v8g3-5gq5-j8gw","title":"Streamsoft Business Intelligence (BI) stores users' passwords in plaintext form in the database\n...","description":"Streamsoft Business Intelligence (BI) stores users' passwords in plaintext form in the database\n\nThis issue was fixed in version 6.8.0.0, users were also requested to change their password on the first login.","status":"published","published":"2026-07-29T15:31:11Z","modified":"2026-07-29T15:31:11Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"cwes":["CWE-256"],"updated_at":"2026-11-02T15:09:54.335538Z"}],"nvd":[{"id":"CVE-2026-50641","description":"Streamsoft Business Intelligence (BI) stores users' passwords in plaintext form in the database\n\nThis issue was fixed in version 6.8.0.0, users were also requested to change their password on the first login.","status":"published","published":"2026-07-29T13:18:53.053Z","modified":"2026-10-23T23:10:00.157Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-256"],"updated_at":"2026-11-02T14:12:33.629616Z"}]}}