CVE-2026-124834: iomad Password Field company_user.php store_temporary_password information disclosure
A security vulnerability has been detected in iomad up to 4.5.15/5.0.11/5.1.8/5.2.4. Affected by this issue is the function storetemporarypassword of the file public/local/iomad/classes/companyuser.php of the component Password Field Handler. Such manipulation leads to information disclosure. The attack may be performed from remote. The attack requires a high level of complexity. The exploitation is known to be difficult. The name of the patch is 0d9c0ccaa8a77583f5dd92eb7be7fbbb8cc6ec9b/9c740fd254fd12d56d7be3b85ac5e9fb4f8c03d8/33755cdd551a84be423b1eaf784d405c1988dbad/7fcf9b52c539a67f3e46a8da6b42ab1d1f26295b. It is advisable to implement a patch to correct this issue. This CVE was requested by the vendor.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
iomadto a version that resolves this vulnerability.Patch 0d9c0ccaa8a77583f5dd92eb7be7fbbb8cc6ec9b/9c740fd254fd12d56d7be3b85ac5e9fb4f8c03d8/33755cdd551a84be423b1eaf784d405c1988dbad/7fcf9b52c539a67f3e46a8da6b42ab1d1f26295b
Event History
Frequently Asked Questions
Which iomad versions are affected?
iomad versions up to 4.5.15, 5.0.11, 5.1.8, and 5.2.4 are affected.
Can this be exploited remotely without authentication?
The attack may be performed remotely, and the supplied vector lists no privileges or user interaction requirements. Exploitation requires high complexity and is described as difficult.
What is the impact of successful exploitation?
Successful exploitation can disclose information through the Password Field Handler's store_temporary_password function. No integrity or availability impact is identified in the supplied severity vector.
What should teams do to remediate this issue?
Implement the vendor-provided patch. The listed patch identifiers are 0d9c0ccaa8a77583f5dd92eb7be7fbbb8cc6ec9b, 9c740fd254fd12d56d7be3b85ac5e9fb4f8c03d8, 33755cdd551a84be423b1eaf784d405c1988dbad, and 7fcf9b52c539a67f3e46a8da6b42ab1d1f26295b.