CallBackery versions before 0.62.0 for Perl expose users to information disclosure by sending them their own password hash and an admin-only note via the getUserConfig function. Non-administrative users can access sensitive notes intended only for administrators, and attackers with a session token can obtain password hashes to attempt offline cracking.