Plaintext Password Storage Vulnerability in Menulux Portal

Menulux Software Inc. has disclosed a security vulnerability affecting the Menulux Portal application (CVE-2026-19051). The vulnerability involves the insecure, plaintext storage of user passwords within the application's data management systems. This flaw allows an attacker or a malicious insider with access to the underlying data stores or application backups to retrieve sensitive authentication credentials without the need for decryption or credential cracking. The issue affects all versions of Menulux Portal released prior to 20260903211448. Organizations relying on this portal for credential management should prioritize patching to the latest version to prevent unauthorized access to sensitive account information.

Impact

Successful exploitation of this vulnerability leads to the exposure of plaintext credentials for users of the Menulux Portal. This poses a significant risk to the confidentiality of user accounts and may facilitate unauthorized access to the portal or other systems where users have reused passwords. As this vulnerability relates to the fundamental storage of credentials, the impact is systemic for the affected platform.

Recommendation

Prioritize the immediate update of all Menulux Portal instances to version 20260903211448 or later. Following the update, security teams should audit existing database and backup files for previously stored plaintext credentials and enforce a mandatory password reset for all users identified in the exposed datasets.