Streamsoft Business Intelligence (BI) is the analytics/reporting module Streamsoft, a Polish ERP vendor headquartered in Zielona Góra, bundles into its two flagship ERP product lines: Streamsoft Verto (cloud-based) and Streamsoft Prestiż (on-premise, Windows/Linux). The BI module aggregates cross-departmental operational data spanning production, logistics, and finance for reporting and analytics, meaning its own account database is a high-value target independent of the core ERP credential store.

CERT Polska (operated by NASK) disclosed CVE-2026-50641 on 2026-07-29 after coordinating with researcher Kamil Dąbkowski, who reported that all Streamsoft BI versions prior to 6.8.0.0 store user account passwords in cleartext in the underlying application database (CWE-256: Plaintext Storage of a Password, a base-level child of CWE-522: Insufficiently Protected Credentials, which is itself a child of CWE-668: Exposure of Resource to Wrong Sphere and CWE-1390: Weak Authentication). No password hashing or encryption at rest is applied to the credential table. MITRE's CWE-256 entry rates the likelihood of exploit for this weakness class as HIGH and notes it is reliably identifiable by automated SAST tooling; per CWE guidance, any actor who obtains read access to the database — via a separate SQL injection flaw, a stolen or misconfigured backup, insider access, or an exposed database service — recovers every affected user's live, working password in immediately usable form, rather than a hash requiring offline cracking.

NVD scored the flaw CVSS v4.0 7.1 (HIGH): AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N (no CVSS v3.1 vector was assessed). The Adjacent (AV:A) attack vector indicates the vulnerable component is reached from an adjacent network segment rather than the open internet, consistent with Streamsoft BI's typical on-premise/internal-LAN deployment alongside Prestiż. The vector reflects only the confidentiality impact of the exposed credential store itself (VC:H); it does not model the downstream impact of an attacker reusing the harvested plaintext credentials elsewhere, which is the primary real-world risk given common password reuse between BI, ERP, and Active Directory accounts in SME environments. NVD's associated CISA Authorized Data Publisher (ADP) SSVC assessment, recorded the same day as publication (2026-07-29), rated exploitation likelihood as "none" and technical impact as "partial" — consistent with the absence of any known PoC or in-the-wild exploitation.

CERT Polska reserved the CVE on 2026-06-05 and published the coordinated advisory on 2026-07-29, alongside the CVE.org record and NVD ingestion the same day; NVD's record was last modified 2026-07-30. No proof-of-concept exploit code, in-the-wild exploitation, or known IOCs/adversary campaign have been reported by any source — CVE-2026-50641 does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog as of this research. Streamsoft had already shipped the fix (version 6.8.0.0) by the time of public disclosure and mandated a forced password reset on next login for upgraded customers, which neutralizes any plaintext passwords an attacker may have already harvested prior to the upgrade.

**Vendor pattern — recurring credential/input-handling weaknesses.** CVE-2026-50641 is the fourth CERT Polska-coordinated vulnerability disclosure against Streamsoft's ERP product line in roughly 16 months, and the fourth reported by the same researcher, Kamil Dąbkowski. On 2025-03-28, CERT Polska jointly disclosed two Streamsoft Prestiż flaws Dąbkowski reported: CVE-2024-7407 (CWE-261, Weak Encoding for Password — passwords encoded with a reversible algorithm from which the original credential can be recovered by observing the encoding process, fixed in 18.2.377) and CVE-2024-11504 (CWE-89, SQL Injection — unsanitized user-entered fields exploitable by an authenticated low-privilege account, CVSS v4.0 8.6 HIGH, fixed in 18.1.376.37). On 2026-03-12, CERT Polska disclosed CVE-2026-0809 (CWE-261 again — a custom token-encoding algorithm in Streamsoft Prestiż allows the KSeF e-invoicing (Krajowy System e-Faktur) token value to be guessed by analyzing tokens with known values, affecting 12.2.363.17 through 20.0.380.91, fixed in 20.0.380.92). Taken together, these four CVEs show a consistent vendor-level pattern of weak/reversible credential and token protection (CWE-261, CWE-256) compounded by insufficient input validation (CWE-89) across both the Prestiż and BI product lines, which should inform risk scoring of any other undisclosed Streamsoft component.

**Related attack patterns (CAPEC).** MITRE's CWE-522 (parent of CWE-256) cross-references several CAPEC attack patterns describing how adversaries operationalize insufficiently protected credentials once obtained: CAPEC-102 (Session Sidejacking), CAPEC-600 (Credential Stuffing), CAPEC-644 (Use of Captured Hashes / Pass the Hash), CAPEC-560 (Use of Known Domain Credentials), CAPEC-652 (Use of Known Kerberos Credentials), and CAPEC-653 (Use of Known Operating System Credentials). These describe the generic post-harvest abuse patterns applicable to any plaintext credential exposure, including this one, rather than techniques specific to Streamsoft BI.