CVE-2023-35866
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
In KeePassXC through 2.7.5, a local attacker can make changes to the Database security settings, including master password and second-factor authentication, within an authenticated KeePassXC Database session, without the need to authenticate these changes by entering the password and/or second-factor authentication to confirm changes.
Risk Assessment
A local attacker can change critical security settings, potentially leading to unauthorized access to sensitive data stored in the database.
Recommendation
It is recommended to update KeePassXC to the latest version to mitigate the risk associated with this vulnerability and consider additional security measures to protect data.
Other vulnerabilities in KeePassXC
See all- CVE-2026-118673Medium
KeePassXC from 2.3.0 until 2.8.0 has a browser integration flaw: authorized response encryption in BrowserMessageBuilder.cpp uses a fixed 1 MiB output vector even though crypto_box_easy() writes plaintext length plus crypto_box_MACBYTES. A browser-protocol client with IPC access and a valid database association can trigger a sequential out-of-bounds write before any response is delivered. Fixed in 2.8.0.
- CVE-2026-69150Medium
In KeePassXC prior to 2.8.0-beta1, KeePass1 / KDB legacy import retains raw Entry pointers in m_entryUuids after deleting metastream entries. When a crafted .kdb file contains an earlier metastream entry followed by a KPX_CUSTOM_ICONS_4 metastream referencing the earlier UUID, parseCustomIcons4() calls Entry::setIcon through the stale pointer, causing a heap use-after-free with a controlled write and a reliable process crash.
Original NVD description (English source)
In KeePassXC through 2.7.5, a local attacker can make changes to the Database security settings, including master password and second-factor authentication, within an authenticated KeePassXC Database session, without the need to authenticate these changes by entering the password and/or second-factor authentication to confirm changes. NOTE: the vendor's position is "asking the user for their password prior to making any changes to the database settings adds no additional protection against a local attacker."
Vulnerability data from NVD (NIST) · CISA KEV · EPSS