p PatchFirst

CVE-2026-1836

CVE-2026-1836 · Stored credentials in Redmine

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The system stores the username and password from the login form after submitting the request. This could allow an attacker with access to the platform to return to the browser and view the login credentials.

CVSS 5.3 · Medium · EPSS 0.1% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • redmine

    Versions
    • ≥ 0, < 6.0.7: Affected (custom)
    • ≥ 0, < 5.1.10: Affected (custom)
    • ≥ 0, < 5.0.14: Affected (custom)
    • 6.0.7: Not affected
    • 5.1.10: Not affected
    • 5.0.14: Not affected

    Update to 5.0.14

  • redmine Debian:12

    Versions
    • 5.0.4-5
    • 5.0.4-5+deb12u1
    • 5.0.4-6
    • 5.0.4-7
    • 5.1.3+ds-1
    • 5.1.3+ds-2
    • 5.1.3+ds-3
    • 5.1.3+ds-4
    • 5.1.3+ds-5
    • 5.1.3+ds-6
    • 6.0.3+ds-1
    • 6.0.3+ds-2
    • 6.0.4+ds-1
    • 6.0.4+ds-2
    • 6.0.4+ds-3
    • 6.0.5+ds-1
    • 6.0.6+ds-1
    • 6.0.6+ds-2
    • 6.0.6+ds-3
    • 6.0.6+ds-4
    • 6.0.6+ds-5
    • 6.0.6+ds-6
    • 6.1.3+ds-1
    • 6.1.3+ds-2
    • 6.1.3+ds-3
    • 6.1.3+ds2-1
    • 6.1.4+ds-1
    • 6.1.4+ds-2
    • 6.1.4+ds-3
    • 6.1.4+ds2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • redmine Debian:13

    Versions
    • 6.0.5+ds-1
    • 6.0.6+ds-1
    • 6.0.6+ds-2
    • 6.0.6+ds-3
    • 6.0.6+ds-4
    • 6.0.6+ds-5
    • 6.0.6+ds-6
    • 6.1.3+ds-1
    • 6.1.3+ds-2
    • 6.1.3+ds-3
    • 6.1.3+ds2-1
    • 6.1.4+ds-1
    • 6.1.4+ds-2
    • 6.1.4+ds-3
    • 6.1.4+ds2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • redmine Debian:14

    Versions
    • 6.0.5+ds-1
    • 6.0.6+ds-1
    • 6.0.6+ds-2
    • 6.0.6+ds-3
    • 6.0.6+ds-4
    • 6.0.6+ds-5
    • 6.0.6+ds-6
    Affected ranges
    • ECOSYSTEM: < 6.1.3+ds-1

    Update to 6.1.3+ds-1

  • redmine Ubuntu:16.04:LTS

    Versions
    • 3.0~20140825-8
    • 3.2.0-1
    • 3.2.0-3
    • 3.2.1-1
    • 3.2.1-2
    • 3.2.1-2ubuntu0.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • redmine Ubuntu:18.04:LTS

    Versions
    • 3.3.1-4
    • 3.4.2-1
    • 3.4.4-1
    • 3.4.4-1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • redmine Ubuntu:20.04:LTS

    Versions
    • 4.0.4-1
    • 4.0.4-3
    • 4.0.6-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →