PT-2026-26655 · Unknown · Cryptomator

CVE-2026-32303 · Publicado 2026-03-20 · Atualizado 2026-03-26

Positive Technologies (AI Summary)

CVSS v3.1

7.6

Alta

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cryptomator versions prior to 1.19.1

Description Cryptomator encrypts data stored on cloud infrastructure. A flaw in integrity checks allows tampering with the vault configuration file, potentially leading to a man-in-the-middle issue during Hub key loading. Before version 1.19.1, the client trusted endpoints from the vault configuration without verifying host authenticity. This could allow an attacker to exfiltrate tokens by substituting a legitimate authentication endpoint with a malicious API endpoint. The issue impacts users unlocking Hub-backed vaults with vulnerable client versions in environments where an attacker can modify the vault.cryptomator file.

Recommendations Update to version 1.19.1 or later.

Exploit

Correção

UI Misrepresentation of Critical Information

Origin Validation Error

Enumeração de Fraquezas

CWE-354

CWE-923

CWE-451

CWE-346

Identificadores relacionados

CVE-2026-32303

GHSA-34RF-RWR3-7G43

Produtos afetados

Cryptomator

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32303.json · Exploit
• https://github.com/cryptomator/cryptomator/pull/4179 · Nota
• https://github.com/cryptomator/cryptomator/releases/tag/1.19.1 · Nota
• https://github.com/cryptomator/cryptomator/commit/6b82abcd80449a30b561d823193f9ecea542a625 · Correção
• https://github.com/cryptomator/cryptomator/security/advisories/GHSA-34rf-rwr3-7g43 · Aviso do Fabricante
• https://twitter.com/integ_sec/status/2037179556226814366 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-32303 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-32303 · Nota de Segurança
• https://twitter.com/CVEnew/status/2035619782599537099 · Publicação no Twitter