{"id":"CVE-2026-118996","kind":"vulnerability","aliases":["CVE-2026-118996"],"related":[],"title":"CallBackery for Perl: users can read their own password hash and admin notes","description":"CallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserConfig.\n\ngetUserConfig() returns the caller's whole cbuser row, including the stored password hash and the note field that the user interface shows only to administrators. getTableData() and getAllFieldValues() in the user management plugins also return the note to users without the admin right.\n\nA non-administrator can read the notes administrators keep about them, and an attacker who obtains a session token can get that user's password hash and crack it offline.","summary":"CallBackery, a Perl web admin framework, returns the full user row through getUserConfig, including the stored password hash and the admin-only note field. Non-administrators can also read admin notes through the user management plugins, and an attacker holding a session token can crack a victim's password hash offline.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["callbackery","package","perl","self-hosted"],"not_affected_if":["admin-only-accounts"],"how_to_check":"- Check the installed CallBackery version; `unknown` for the exact command, the sources do not say how it is installed.\n- Look for the user management plugins (getTableData, getAllFieldValues) in the deployed code.","fix":"- CallBackery versions before `0.62.0` are affected; move to `0.62.0` or later.","status":"open","published_at":"2026-10-30T13:18:32+00:00","first_seen_at":"2026-10-30T13:30:27+00:00","triaged_at":"2026-10-30T13:32:23+00:00","updated_at":"2026-10-30T13:32:23+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T13:32:23Z","model":"claude-haiku-5-5","output":{"fix":"- CallBackery versions before `0.62.0` are affected; move to `0.62.0` or later.","reach":"network","title":"CallBackery for Perl: users can read their own password hash and admin notes","impact":"medium","summary":"CallBackery, a Perl web admin framework, returns the full user row through getUserConfig, including the stored password hash and the admin-only note field. Non-administrators can also read admin notes through the user management plugins, and an attacker holding a session token can crack a victim's password hash offline.","audience":"businesses","category":"package","nicknames":[],"who_cares":["perl","callbackery","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Password hashes of users readable, enabling offline cracking and admin notes exposed","analyst_note":"","how_to_check":"- Check the installed CallBackery version; `unknown` for the exact command, the sources do not say how it is installed.\n- Look for the user management plugins (getTableData, getAllFieldValues) in the deployed code.","plain_action":"","needs_analyst":false,"not_affected_if":["admin-only-accounts"],"who_is_affected":"Teams running CallBackery for Perl as an admin web interface with user accounts that are not administrators. Exposure comes from the getUserConfig call and the user management plugins returning data beyond what the user interface shows. Deployments where only administrators have accounts are less exposed, though the sources do not say this explicitly.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.00069,"input_tokens":4185,"output_tokens":543,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118996':16A,19A '-2026':15A,18A '0.62.0':82C 'admin':12A,30B,47B,57B,94C,141C 'admin-on':46B,93C 'administr':53B,124C,146C,151C 'also':55B,133C 'attack':66B,157C 'callbackeri':1A,20B,26B,79C 'caller':103C 'cbuser':106C 'crack':72B,171C 'cve':14A,17A 'field':50B,116C 'framework':31B 'full':34B 'get':164C 'getallfieldvalu':127C 'gettabledata':125C 'getuserconfig':38B,99C,100C 'hash':10A,43B,77B,90C,112C,169C 'hold':67B 'host':25B 'includ':39B,108C 'interfac':120C 'keep':152C 'manag':62B,131C 'non':52B,145C 'non-administr':51B,144C 'note':13A,49B,58B,97C,115C,136C,150C 'obtain':159C 'offlin':78B,173C 'packag':21B 'password':9A,42B,76B,89C,111C,168C 'perl':3A,22B,28B,84C 'plugin':63B,132C 'read':6A,56B,148C 'return':32B,101C,134C 'right':142C 'row':36B,107C 'self':24B 'self-host':23B 'send':85C 'session':69B,161C 'show':121C 'store':41B,110C 'token':70B,162C 'user':4A,35B,61B,86C,96C,119C,130C,138C,166C 'version':80C 'via':98C 'victim':74B 'web':29B 'whole':105C 'without':139C","nicknames":[],"mitigations":[],"who_affected":"Teams running CallBackery for Perl as an admin web interface with user accounts that are not administrators. Exposure comes from the getUserConfig call and the user management plugins returning data beyond what the user interface shows. Deployments where only administrators have accounts are less exposed, though the sources do not say this explicitly.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T13:18:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118996","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118996","severity":null,"published_at":"2026-10-30T13:18:32+00:00","modified_at":"2026-10-30T13:18:32+00:00","first_seen_at":"2026-10-30T13:30:27+00:00","fetched_at":"2026-10-30T13:30:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}