Description
A security vulnerability has been detected in iomad up to 4.5.15/5.0.11/5.1.8/5.2.4. Affected by this issue is the function store_temporary_password of the file public/local/iomad/classes/company_user.php of the component Password Field Handler. Such manipulation leads to information disclosure. The attack may be performed from remote. The attack requires a high level of complexity. The exploitation is known to be difficult. The name of the patch is 0d9c0ccaa8a77583f5dd92eb7be7fbbb8cc6ec9b/9c740fd254fd12d56d7be3b85ac5e9fb4f8c03d8/33755cdd551a84be423b1eaf784d405c1988dbad/7fcf9b52c539a67f3e46a8da6b42ab1d1f26295b. It is advisable to implement a patch to correct this issue. This CVE was requested by the vendor.
Published: 2026-11-09
Score: 6.3 Medium
EPSS: n/a
KEV: No
Impact: Information disclosure
Action: Apply patch
AI Analysis

Impact

A vulnerability is present in the store_temporary_password function of the Password Field Handler within iomad. The flaw allows an attacker to read sensitive information that should be protected, leading to an information disclosure scenario. The weakness is classified as a data exposure and an authorization failure.

Affected Systems

Versions of iomad up to 4.5.15, 5.0.11, 5.1.8, and 5.2.4 are affected. The product is the iomad web application used for organizational management. Any installation running those releases is potentially vulnerable, regardless of deployment size or configuration.

Risk and Exploitability

The CVSS score is 6.3, indicating a medium severity. EPSS for this CVE is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, but it requires a high level of complexity and is known to be difficult, which moderates the overall exploitation risk. Nevertheless, the potential for confidential data leakage warrants prompt attention.

Generated by OpenCVE AI on November 9, 2026 at 20:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the official patch or upgrade to a version newer than 5.2.4 that includes the fix.
  • Ensure that the Password Field Handler’s temporary password endpoint is not exposed to unauthenticated users by configuring web server access controls or firewall rules.
  • Review and enforce role‑based access controls within iomad to prevent unauthorized disclosure of sensitive data.

Generated by OpenCVE AI on November 9, 2026 at 20:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 09 Nov 2026 19:30:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in iomad up to 4.5.15/5.0.11/5.1.8/5.2.4. Affected by this issue is the function store_temporary_password of the file public/local/iomad/classes/company_user.php of the component Password Field Handler. Such manipulation leads to information disclosure. The attack may be performed from remote. The attack requires a high level of complexity. The exploitation is known to be difficult. The name of the patch is 0d9c0ccaa8a77583f5dd92eb7be7fbbb8cc6ec9b/9c740fd254fd12d56d7be3b85ac5e9fb4f8c03d8/33755cdd551a84be423b1eaf784d405c1988dbad/7fcf9b52c539a67f3e46a8da6b42ab1d1f26295b. It is advisable to implement a patch to correct this issue. This CVE was requested by the vendor.
Title iomad Password Field company_user.php store_temporary_password information disclosure
First Time appeared Iomad
Iomad iomad
Weaknesses CWE-200
CWE-284
CPEs cpe:2.3:a:iomad:iomad:*:*:*:*:*:*:*:*
Vendors & Products Iomad
Iomad iomad
References
Metrics cvssV2_0

{'score': 2.6, 'vector': 'AV:N/AC:H/Au:N/C:P/I:N/A:N/E:ND/RL:OF/RC:C'}

cvssV3_0

{'score': 3.7, 'vector': 'CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C'}

cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C'}

cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X'}

Subscriptions

Iomad Iomad
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-11-09T19:15:13.684Z

Reserved: 2026-11-09T13:56:27.082Z

Link: CVE-2026-124834

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-11-09T20:18:10.720

Modified: 2026-11-09T20:18:10.877

Link: CVE-2026-124834

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-09T20:30:16Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control