{"id":"CVE-2023-35866","aliases":["EUVD-2023-39859","GHSA-65v5-9w4x-xh53"],"status":"disputed","title":"In KeePassXC through 2.7.5, a local attacker can make changes to the Database security settings,...","description":"In KeePassXC through 2.7.5, a local attacker can make changes to the Database security settings, including master password and second-factor authentication, within an authenticated KeePassXC Database session, without the need to authenticate these changes by entering the password and/or second-factor authentication to confirm changes. NOTE: the vendor's position is \"asking the user for their password prior to making any changes to the database settings adds no additional protection against a local attacker.\"","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00239,"percentile":0.15064,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-863"],"published":"2023-06-19T00:00:00Z","modified":"2026-10-28T02:30:38Z","products":[{"vendor":"keepassxc","product":"keepassxc"}],"references":[{"url":"https://github.com/keepassxreboot/keepassxc/issues/9391","tags":["x_transferred","Issue Tracking","report"]},{"url":"https://github.com/keepassxreboot/keepassxc/issues/9339","tags":["x_transferred","Issue Tracking","report"]},{"url":"https://github.com/keepassxreboot/keepassxc/issues/9339#issuecomment-1598219482","tags":["x_transferred","Issue Tracking","report"]},{"url":"https://keepassxc.org/docs/#faq-yubikey-2fa","tags":["x_transferred","Product","web"]},{"url":"https://medium.com/%40cybercitizen.tech/keepassxc-vulnerability-cve-2023-35866-dc7d447c4903","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-35866","tags":["advisory"]},{"url":"https://medium.com/@cybercitizen.tech/keepassxc-vulnerability-cve-2023-35866-dc7d447c4903"},{"url":"https://github.com/advisories/GHSA-65v5-9w4x-xh53"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/35xxx/CVE-2023-35866.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-35866","description":"In KeePassXC through 2.7.5, a local attacker can make changes to the Database security settings, including master password and second-factor authentication, within an authenticated KeePassXC Database session, without the need to authenticate these changes by entering the password and/or second-factor authentication to confirm changes. NOTE: the vendor's position is \"asking the user for their password prior to making any changes to the database settings adds no additional protection against a local attacker.\"","status":"disputed","published":"2023-06-19T00:00:00Z","modified":"2024-12-11T16:53:22.97Z","cwes":["CWE-863"],"updated_at":"2026-11-02T14:35:33.794347Z"}],"euvd":[{"id":"EUVD-2023-39859","description":"In KeePassXC through 2.7.5, a local attacker can make changes to the Database security settings, including master password and second-factor authentication, within an authenticated KeePassXC Database session, without the need to authenticate these changes by entering the password and/or second-factor authentication to confirm changes. NOTE: the vendor's position is \"asking the user for their password prior to making any changes to the database settings adds no additional protection against a local attacker.\"","status":"published","published":"2023-06-19T00:00:00Z","modified":"2024-12-11T16:53:22Z","updated_at":"2026-11-03T00:04:36.867108Z"}],"ghsa":[{"id":"GHSA-65v5-9w4x-xh53","title":"In KeePassXC through 2.7.5, a local attacker can make changes to the Database security settings,...","description":"In KeePassXC through 2.7.5, a local attacker can make changes to the Database security settings, including master password and second-factor authentication, within an authenticated KeePassXC Database session, without the need to authenticate these changes by entering the password and/or second-factor authentication to confirm changes.","status":"published","published":"2023-06-19T06:30:42Z","modified":"2024-12-11T18:30:35Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:59:08.209902Z"}],"nvd":[{"id":"CVE-2023-35866","description":"In KeePassXC through 2.7.5, a local attacker can make changes to the Database security settings, including master password and second-factor authentication, within an authenticated KeePassXC Database session, without the need to authenticate these changes by entering the password and/or second-factor authentication to confirm changes. NOTE: the vendor's position is \"asking the user for their password prior to making any changes to the database settings adds no additional protection against a local attacker.\"","status":"disputed","published":"2023-06-19T06:15:09.24Z","modified":"2026-06-17T06:05:22.397Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:08:06.335469Z"}],"osv":[{"id":"CVE-2023-35866","description":"In KeePassXC through 2.7.5, a local attacker can make changes to the Database security settings, including master password and second-factor authentication, within an authenticated KeePassXC Database session, without the need to authenticate these changes by entering the password and/or second-factor authentication to confirm changes. NOTE: the vendor's position is \"asking the user for their password prior to making any changes to the database settings adds no additional protection against a local attacker.\"","status":"published","published":"2023-06-19T00:00:00Z","modified":"2026-10-28T02:30:38.78555802Z","updated_at":"2026-11-02T15:44:32.510144Z"}]}}