Thunderbird Allows Access to Inbox, Deletion, and Viewing of Unencrypted Messages Without Password After Clicking "Cancel" on Password Prompt Pop-up
Categories
(Thunderbird :: Security, defect)
Tracking
(Not tracked)
People
(Reporter: zerocol101, Unassigned)
Details
User Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Steps to reproduce:
Configure an email account in Thunderbird with a password.
Set up a master password to protect Thunderbird.
Close Thunderbird and reopen it.
When Thunderbird starts, it prompts for the account password.
Click the "Cancel" button instead of entering the password.
Despite clicking "Cancel", you can access the inbox and read all emails without providing the password.
The application also allows access without requiring the master password if you click "Cancel" on the master password prompt.
Actual results:
The inbox is accessible even after clicking "Cancel" without entering the password.
The master password does not prevent access, and the application opens without requiring the master password.
All emails are accessible without any authentication.
Expected results:
Thunderbird should block access to the inbox if the user clicks "Cancel" on the password prompt.
It should not be possible to bypass the password prompt by clicking "Cancel".
The application should also block access if the user cancels the master password prompt.
|
Reporter | |
Comment 1•9 months ago
|
||
I used the default config and the bug's still there, and also some strong config and same.
|
|
Reporter | |
Updated•9 months ago
|
|
||
Comment 2•9 months ago
|
||
Account passwords have never protected nor prevented access to messages that have already been downloaded into Thunderbird.
Account passwords are only for protecting access to your mail server, meaning access to messages that exist only on the server and have not yet been downloaded to Thunderbird. That will never change.
The primary password part of your report is Bug 1566458 - Optionally protect the startup of Thunderbird using the Primary (Master) Password
Description
•