CVE-2026-118996: CallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserConfig

Published Oct 30, 2026

Updated

CallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserConfig.

getUserConfig() returns the caller's whole cbuser row, including the stored password hash and the note field that the user interface shows only to administrators. getTableData() and getAllFieldValues() in the user management plugins also return the note to users without the admin right.

A non-administrator can read the notes administrators keep about them, and an attacker who obtains a session token can get that user's password hash and crack it offline.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade CallBackery to a version that resolves this vulnerability.
Fixed in 0.62.0

Event History

Oct 30, 2026

CVE Published

via MITRE·01:10 PM

Data Sourced

via MITRE·01:10 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·01:18 PM

DescriptionWeakness

Frequently Asked Questions

Which users can access information they should not be able to see?

Any non-administrator can read the admin-only note associated with their own user record through getUserConfig(). The user management plugins may also expose the note through getTableData() and getAllFieldValues() to users without the admin right.

What does an attacker need to obtain a password hash?

The attacker needs a valid session token for a user account. With that token, they can call getUserConfig() for that user and retrieve the stored password hash for offline cracking.

Are only administrator accounts at risk of password-hash exposure?

No. getUserConfig() returns the caller's full cbuser row, including that caller's stored password hash. A stolen session token exposes the hash belonging to the account represented by that token.

What version addresses this issue?

The issue affects CallBackery for Perl versions before 0.62.0. Version 0.62.0 is the first version identified as not affected by the provided information.

CVE-2026-118996: CallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserConfig

Remediation

Event History

Frequently Asked Questions

Which users can access information they should not be able to see?

What does an attacker need to obtain a password hash?

Are only administrator accounts at risk of password-hash exposure?

What version addresses this issue?

Company

Resources

Contact

Frequently Asked Questions

Which users can access information they should not be able to see?

What does an attacker need to obtain a password hash?

Are only administrator accounts at risk of password-hash exposure?

What version addresses this issue?