CVE-2025-70050
Received Received - Intake
Cleartext Storage Vulnerability in Lesspass v9.6.9 Exposes Sensitive Data

Publication date: 2026-03-09

Last updated on: 2026-03-13

Assigner: MITRE

Description
An issue pertaining to CWE-312: Cleartext Storage of Sensitive Information was discovered in lesspass lesspass v9.6.9 which allows attackers to obtain sensitive information.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-09
Last Modified
2026-03-13
Generated
2026-06-16
AI Q&A
2026-03-09
EPSS Evaluated
2026-06-15
NVD
CVE-2025-70050
EUVD
EUVD-2025-208428
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
lesspass lesspass 9.6.9
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-312 The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2025-70050 is a vulnerability in lesspass version 9.6.9 related to CWE-312, which is the cleartext storage of sensitive information.

This means that the application stores sensitive data in an unencrypted, cleartext format. As a result, if an attacker gains access to the storage medium where this data is kept, they can obtain confidential information without needing to bypass encryption.

Compliance Impact

I don't know

Impact Analysis

The vulnerability can lead to unauthorized access and exposure of sensitive information stored by the lesspass application.

If an attacker compromises the storage location, they can retrieve confidential data easily because it is not encrypted.

Detection Guidance

This vulnerability involves the cleartext storage of sensitive information in lesspass version 9.6.9. Detection would focus on identifying unencrypted sensitive data stored by this specific version of the software.

Since the vulnerability is related to stored data rather than network traffic, detection commands would involve inspecting files or storage locations used by lesspass for sensitive data in cleartext.

Specific commands are not provided in the available resources.

Mitigation Strategies

The vulnerability is due to cleartext storage of sensitive information in lesspass version 9.6.9.

Immediate mitigation steps would include:

  • Avoid using lesspass version 9.6.9 until a fixed version is released.
  • Remove or securely delete any sensitive data stored by this version of lesspass.
  • Monitor for updates or patches from the lesspass project and apply them promptly.
Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-70050. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart