CVE-2026-118996: Improper Removal of Sensitive Data Before Storage or Transfer

CallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserConfig. getUserConfig returns the caller's whole cbuser row, including the stored password hash and the note field that the user interface shows only to administrators...