Cerebrate users experiencing self‑registration requests had their hashed passwords stored in the inbox message payload and subsequently returned via inbox index, view, and audit log endpoints in raw form. The exposed data is a password hash rather than plaintext, but disclosure facilitates offline password‑cracking attempts and can pose additional risk if users reuse passwords across environments. The weakness falls under CWE‑200, a confidentiality breach.

The vulnerability affects Cerebrate prior to version 1.37. The Inbox self‑registration request handling and audit logging components exhibit the flaw. Versions 1.37 and later have the fix applied.

The CVSS score of 5.1 indicates a moderate impact with a 10% impact rating under the CVSS v3.1 formula. The EPSS score is not available, but the vulnerability is not listed in CISA’s KEV catalog, suggesting no current publicly known exploitation. An attacker must be authenticated with sufficient privileges to access inbox entries or related audit logs, making the attack vector limited to privileged accounts. Once accessed, the attacker can retrieve plain hashed passwords for pending registration requests and potentially use offline cracking methods to compromise user accounts.