CVE-2026-32303
Prior to version 1.19.1, an integrity check vulnerability allows an attacker to tamper with the vault configuration file leading to a man-in-the-middle vulnerability in Hub key loading mechanism.
Does this matter?
Lower severity and a low EPSS score (0.11%). Track it; it rarely justifies an emergency change on its own.
Description
Cryptomator encrypts data being stored on cloud infrastructure. Prior to version 1.19.1, an integrity check vulnerability allows an attacker to tamper with the vault configuration file leading to a man-in-the-middle vulnerability in Hub key loading mechanism. Before this fix, the client trusted endpoints from the vault config without host authenticity checks, which could allow token exfiltration by mixing a legitimate auth endpoint with a malicious API endpoint. Impacted are users unlocking Hub-backed vaults with affected client versions in environments where an attacker can alter the vault.cryptomator file. This issue has been patched in version 1.19.1.
- CVSS 3.1
- 5.9 MEDIUMCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
- EPSS
- 0.11% probability · 1th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-346, CWE-354, CWE-451, CWE-923
- Affected
- cryptomator/cryptomator
- Source
- security-advisories@github.com
References
- https://github.com/cryptomator/cryptomator/commit/6b82abcd80449a30b561d823193f9ecea542a625Patch
- https://github.com/cryptomator/cryptomator/pull/4179Issue Tracking
- https://github.com/cryptomator/cryptomator/releases/tag/1.19.1Release Notes
- https://github.com/cryptomator/cryptomator/security/advisories/GHSA-34rf-rwr3-7g43Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.