CVE-2026-118996
Received Received - Intake

Information Disclosure in CallBackery for Perl

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: CPANSec

Description
CallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserConfig. getUserConfig() returns the caller's whole cbuser row, including the stored password hash and the note field that the user interface shows only to administrators. getTableData() and getAllFieldValues() in the user management plugins also return the note to users without the admin right. A non-administrator can read the notes administrators keep about them, and an attacker who obtains a session token can get that user's password hash and crack it offline.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-118996
EUVD
EUVD-2026-113914

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
callbackery callbackery to 0.62.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-212 The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CallBackery versions before 0.62.0 for Perl have a flaw where the getUserConfig function exposes sensitive data. It returns the entire cbuser row for the caller, including their password hash and admin-only user notes. Additionally, getTableData and getAllFieldValues in user management plugins also leak the admin notes to non-admin users.

Detection Guidance

Check if CallBackery versions before 0.62.0 are installed by running commands like 'npm list callbackery' or 'cpanm Callbackery'. Inspect API responses for getUserConfig() to see if it returns password hashes or admin notes. Monitor user sessions for unauthorized access to sensitive data.

Impact Analysis

An attacker with a session token can retrieve a user's password hash and crack it offline. Non-admin users can read notes administrators wrote about them. This could lead to unauthorized access, data breaches, or exposure of confidential information.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal data and potential data breaches. For HIPAA, exposure of user notes or password hashes could compromise protected health information. Compliance failures may result in legal penalties and reputational damage.

Mitigation Strategies

Upgrade CallBackery to version 0.62.0 or later immediately. Review and restrict access to getUserConfig() and related functions. Rotate all user passwords and invalidate active sessions. Audit logs for suspicious access to password hashes or admin notes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-118996. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart