Live › vulnerability › CVE-2026-118996
CallBackery, a Perl web admin framework, returns the full user row through getUserConfig, including the stored password hash and the admin-only note field. Non-administrators can also read admin notes through the user management plugins, and an attacker holding a session token can crack a victim's password hash offline.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 13:30 UTC. All times on this page are UTC.
Teams running CallBackery for Perl as an admin web interface with user accounts that are not administrators. Exposure comes from the getUserConfig call and the user management plugins returning data beyond what the user interface shows. Deployments where only administrators have accounts are less exposed, though the sources do not say this explicitly.
No product ranges from the sources yet.
unknown for the exact command, the sources do not say how it is installed.0.62.0 are affected; move to 0.62.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserConfig.
getUserConfig() returns the caller's whole cbuser row, including the stored password hash and the note field that the user interface shows only to administrators. getTableData() and getAllFieldValues() in the user management plugins also return the note to users without the admin right.
A non-administrator can read the notes administrators keep about them, and an attacker who obtains a session token can get that user's password hash and crack it offline.
This page as .md · .json · in your agent: get_signal("CVE-2026-118996")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.