Information Disclosure Vulnerability in Iomad's Password Field Handler
CVE-2026-124834

6.3MEDIUM

Key Information:

Vendor

Iomad

Status
Iomad
Vendor
CVE Published:
9 November 2026

What is CVE-2026-124834?

A security vulnerability has been identified in the Iomad product, specifically within the Password Field Handler of the company_user.php file. The function store_temporary_password is at risk, leading to potential unauthorized information disclosure. Attackers can exploit this vulnerability remotely, although its complexity makes exploitation challenging. The vendor has provided a patch, which is essential to mitigate this issue. Users of affected Iomad versions are advised to implement the necessary updates to secure their system effectively.

Affected Version(s)

iomad 4.5.0

iomad 4.5.1

iomad 4.5.2

References

https://vuldb.com/vuln/433149
vdb-entrytechnical-description
https://vuldb.com/vuln/433149/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-124834
third-party-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Christian Schneider
VulDB GitHub Commit Analyzer
VulDB CNA Team
.