PT-2026-26660 · Cryptomator · Cryptomator For Ios

Leekiyoon-Sec · Publicado 2026-03-20 · Atualizado 2026-03-22 · CVE-2026-32318

Positive Technologies (AI Summary)

CVSS v3.1

7.6

Alta

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cryptomator for iOS versions prior to 2.8.3

Description Cryptomator for iOS provides client-side encryption for files in the cloud. A flaw in integrity checks allows tampering with the vault configuration file, potentially leading to a man-in-the-middle attack during the Hub key loading process. Previously, the client trusted endpoints from the vault configuration without verifying host authenticity, which could allow an attacker to steal authentication tokens by substituting a legitimate authentication endpoint with a malicious API endpoint. The issue impacts users unlocking Hub-backed vaults with vulnerable client versions in environments where an attacker can modify the vault.cryptomator file.

Recommendations Update to version 2.8.3 or later.

Exploit

Correção

UI Misrepresentation of Critical Information

Origin Validation Error

Enumeração de Fraquezas

CWE-923

CWE-354

CWE-451

CWE-346

Identificadores relacionados

CVE-2026-32318

GHSA-G7FR-C82R-HM6J

Produtos afetados

Cryptomator For Ios

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32318.json · Exploit
• https://github.com/cryptomator/ios/pull/444 · Nota
• https://github.com/cryptomator/ios/security/advisories/GHSA-g7fr-c82r-hm6j · Aviso do Fabricante
• https://github.com/cryptomator/ios/commit/98c31280304af65c0932eb547d5fe4be2d16929c · Correção
• https://github.com/cryptomator/ios/releases/tag/2.8.3 · Nota
• https://osv.dev/vulnerability/CVE-2026-32318 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2035619778883354792 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-32318 · Nota de Segurança