CVE-2025-70050
Cleartext Storage Vulnerability in Lesspass v9.6.9 Exposes Sensitive Data
Publication date: 2026-03-09
Last updated on: 2026-03-13
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| lesspass | lesspass | 9.6.9 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-312 | The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
Can you explain this vulnerability to me?
CVE-2025-70050 is a vulnerability in lesspass version 9.6.9 related to CWE-312, which is the cleartext storage of sensitive information.
This means that the application stores sensitive data in an unencrypted, cleartext format. As a result, if an attacker gains access to the storage medium where this data is kept, they can obtain confidential information without needing to bypass encryption.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized access and exposure of sensitive information stored by the lesspass application.
If an attacker compromises the storage location, they can retrieve confidential data easily because it is not encrypted.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves the cleartext storage of sensitive information in lesspass version 9.6.9. Detection would focus on identifying unencrypted sensitive data stored by this specific version of the software.
Since the vulnerability is related to stored data rather than network traffic, detection commands would involve inspecting files or storage locations used by lesspass for sensitive data in cleartext.
Specific commands are not provided in the available resources.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is due to cleartext storage of sensitive information in lesspass version 9.6.9.
Immediate mitigation steps would include:
- Avoid using lesspass version 9.6.9 until a fixed version is released.
- Remove or securely delete any sensitive data stored by this version of lesspass.
- Monitor for updates or patches from the lesspass project and apply them promptly.