CVE-2026-124834
iomad Password Field company_user.php store_temporary_password information disclosure
A security vulnerability has been detected in iomad up to 4.5.15/5.0.11/5.1.8/5.2.4. Affected by this issue is the function store_temporary_password of the file public/local/iomad/classes/company_user.php of the component Password Field Handler. Such manipulation leads to information disclosure. The attack may be performed from remote. The attack requires a high level of complexity. The exploitation is known to be difficult. The name of the patch is 0d9c0ccaa8a77583f5dd92eb7be7fbbb8cc6ec9b/9c740fd254fd12d56d7be3b85ac5e9fb4f8c03d8/33755cdd551a84be423b1eaf784d405c1988dbad/7fcf9b52c539a67f3e46a8da6b42ab1d1f26295b. It is advisable to implement a patch to correct this issue. This CVE was requested by the vendor.
Public vulnerability details
- Record state
- Published
- Published (UTC)
- Last updated (UTC)
- Assigned by
- VulDB
- CVSS score
- 6.3 (CVSS v4.0, from VulDB)
- Severity
- MEDIUM
- CISA KEV
- No KEV entry in this record. This does not show that the CVE is absent from the KEV catalog.
- Additional data from
- None
FHE assessment
No FHE assessment is available in this application yet. This does not mean FHE cannot mitigate an impact of this CVE.
References
- VDB-433149 | iomad Password Field company_user.php store_temporary_password information disclosure (VulDB)
- VDB-433149 | CTI Indicators (IOB, IOC, TTP, IOA) (VulDB)
- CVE-2026-124834 | CVE Analysis and Report (VulDB)
- https://github.com/iomad/iomad/issues/2831 (VulDB)
- https://github.com/iomad/iomad/commit/7fcf9b52c539a67f3e46a8da6b42ab1d1f26295b (VulDB)
- https://github.com/iomad/iomad/ (VulDB)
Source
CVE JSON 5.2 record from the CVE List archive 2026-11-09_delta_CVEs_at_end_of_day.zip, which covers changes through . Imported .