An issue exists AccountService 0.6.37 in the user_change_password_authorized_cb() function in user.c which could let a local users obtain encrypted passwords.
CVSS 3.1LOW 3.3·Local·Low privileges·No interaction·EPSS 0.00448·Published 2019-11-27·Will not fixCWE-732