CVE-2026-118996

MediumCVSS 4.9/10Last modified Nov 6, 2026

Description

CallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserConfig.

getUserConfig() returns the caller's whole cbuser row, including the stored password hash and the note field that the user interface shows only to administrators. getTableData() and getAllFieldValues() in the user management plugins also return the note to users without the admin right.

A non-administrator can read the notes administrators keep about them, and an attacker who obtains a session token can get that user's password hash and crack it offline.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-212

Affected software

Vendor	Product	Versions
—	—	< 0.62.0

References

https://metacpan.org/release/OETIKER/CallBackery-0.62.0/changes

Timeline

Published: Oct 30, 2026
Last modified: Nov 6, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-11903.1A flaw was found in Keycloak's SAML brokering functionality. When Keycloak is configured as a client in a Security Assertion Markup Language CVE-2026-119004.3The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and incl CVE-2026-119015.3The WP Hotel Booking plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in all versions up to, and includi CVE-2026-1190179.9Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the contex CVE-2026-1190257.5open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafte CVE-2026-1190277.5oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying a crafted serve CVE-2026-1190288.8oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying non-literal enu CVE-2026-119035.4Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc modul CVE-2026-1190325.3The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not check that the importing user may edit the posts named in a CVE-2026-1190332.2The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not verify that a user may edit a post before letting them chang CVE-2026-1190345.3The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not verify that a post is publicly viewable before returning its CVE-2026-1190356.4The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not safely encode its structured data output when the Pretty Pri