CVE-2026-53912

Name of the Vulnerable Software and Affected Versions Cerebrate versions prior to 1.37

Description The self-registration workflow stores the registrant's hashed password in the inbox message data payload. This payload is returned unredacted through inbox index and view responses, including HTML, JSON, and CSV outputs, and can be written unredacted into audit log entries for the inbox message. An authenticated user with sufficient privileges to access inbox entries or related audit logs can retrieve these password hashes. While the exposed data is hashed rather than plaintext, it may facilitate offline password-cracking attempts, especially if users reuse passwords across different systems.

Recommendations Update to version 1.37.