---
id: "CVE-2026-118996"
kind: "vulnerability"
aliases: ["CVE-2026-118996"]
title: "CallBackery for Perl: users can read their own password hash and admin notes"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["callbackery", "package", "perl", "self-hosted"]
not_affected_if: ["admin-only-accounts"]
published_at: "2026-10-30T13:18:32+00:00"
first_seen_at: "2026-10-30T13:30:27+00:00"
updated_at: "2026-10-30T13:32:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118996", "first_seen_at": "2026-10-30T13:30:27+00:00"}]
---

# CallBackery for Perl: users can read their own password hash and admin notes

CallBackery, a Perl web admin framework, returns the full user row through getUserConfig, including the stored password hash and the admin-only note field. Non-administrators can also read admin notes through the user management plugins, and an attacker holding a session token can crack a victim's password hash offline.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed CallBackery version; `unknown` for the exact command, the sources do not say how it is installed.
- Look for the user management plugins (getTableData, getAllFieldValues) in the deployed code.

## Fix

- CallBackery versions before `0.62.0` are affected; move to `0.62.0` or later.

## Timeline

- 2026-10-30T13:30:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118996

## From the sources

CallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserConfig.

getUserConfig() returns the caller's whole cbuser row, including the stored password hash and the note field that the user interface shows only to administrators. getTableData() and getAllFieldValues() in the user management plugins also return the note to users without the admin right.

A non-administrator can read the notes administrators keep about them, and an attacker who obtains a session token can get that user's password hash and crack it offline.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_