A flaw in CallBackery’s configuration endpoints allows a non‑administrator to retrieve the full user record, including the hashed password and notes intended only for administrators, through getUserConfig, getTableData, and getAllFieldValues. The result is the disclosure of sensitive authentication data and confidential admin remarks, enabling attackers to acquire password hashes and potentially crack them offline, as well as access private notes about the user.

The vulnerability affects all versions of CallBackery written in Perl that precede 0.62.0. Any deployment that exposes the getUserConfig, getTableData, or getAllFieldValues APIs to unprivileged users is impacted. No specific external platform versions are listed; all older releases are vulnerable.

The risk is significant because the exposed data allows user impersonation and private data theft. Exploitation requires that the attacker have a valid session token or login credentials for the target user. EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, but the lack of protection for stored password hashes and admin notes makes it highly valuable to adversaries. The CVSS score is not supplied in the available data.