Not rated
CVE-2020-6794 If a user saved passwords before Thunderbird 60 and then later set a master password, an unencrypted copy of these…
Description
If a user saved passwords before Thunderbird 60 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the older stored password file was not deleted when the data was copied to a new format starting in Thunderbird 60. The new master password is added only on the new file. This could allow the exposure of stored password data outside of user expectations. This vulnerability affects Thunderbird < 68.5.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Thunderbird 68.5 | earliest → < 68.5 | 68.5 |
Other CVEs of Thunderbird
The 1713 CVEs of Thunderbird →
CVE-2026-118180
Matrix homeserver could redirect the chat session to a local file or network share
7.5
High
CVE-2026-118179
Request forgery via news: links
8.8
High
CVE-2026-118178
RSS feed could redirect its subscription to a local file or network share
5.7
Medium
CVE-2026-118177
Calendar discovery accepted local file and remote network share locations
9.1
Critical