CVE-2026-118996

CallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserConfig. getUserConfig returns the caller's whole cbuser row, including the stored password hash and the note field that the user interface shows only to administrators...

CVE-2026-118996 CallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserConfig

CallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserConfig. getUserConfig returns the caller's whole cbuser row, including the stored password hash and the note field that the user interface shows only to administrators...

CVE-2026-118996

Versions of CallBackery for Perl prior to 0.62.0 are vulnerable to information disclosure. The getUserConfig() function returns the entire cbuser row, including the stored password hash and an admin-only user note . Additionally, the getTableData() and getAllFieldValues() functions in the user ma...

EUVD-2026-113914

CallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserConfig. getUserConfig returns the caller's whole cbuser row, including the stored password hash and the note field that the user interface shows only to administrators...

PT-2026-133537

CallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserConfig. getUserConfig returns the caller's whole cbuser row, including the stored password hash and the note field that the user interface shows only to administrators...