CVE-2026-118996None▾ SunlitCallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserConfig. getUserConfig() returns the caller's whole cbuser row, including the stored password hash and the note field …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
CallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserConfig.
getUserConfig() returns the caller's whole cbuser row, including the stored password hash and the note field that the user interface shows only to administrators. getTableData() and getAllFieldValues() in the user management plugins also return the note to users without the admin right.
A non-administrator can read the notes administrators keep about them, and an attacker who obtains a session token can get that user's password hash and crack it offline.
CallBackery < 0.62.0Upgrade to CallBackery 0.62.0 or later.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-118992High· 8.4CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup
CVE-2026-118987NoneCallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header
CVE-2026-118990NoneCallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup
CVE-2026-118986NoneCallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand()
CVE-2026-118991NoneCallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES key
CVE-2026-118994NoneCallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name