PT-2026-26659 · Cryptomator · Cryptomator For Android

Published 2026-03-20 · Updated 2026-03-22 · CVE-2026-32317

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cryptomator for Android versions prior to 1.12.3

Description Cryptomator for Android provides client-side encryption for files in the cloud. A flaw in integrity checks allows tampering with the vault configuration file, potentially leading to a man-in-the-middle attack during the Hub key loading process. Specifically, the client previously trusted endpoints from the vault configuration without verifying host authenticity. This could allow an attacker to exfiltrate tokens by substituting a legitimate authentication endpoint with a malicious API endpoint. The issue impacts users unlocking Hub-backed vaults in environments where an attacker can modify the vault.cryptomator file.

Recommendations Update to version 1.12.3 or later.

Exploit

Fix

UI Misrepresentation of Critical Information

Origin Validation Error

Weakness Enumeration

CWE-923

CWE-354

CWE-451

CWE-346

Related Identifiers

CVE-2026-32317

GHSA-876Q-Q3MM-FCVJ

Affected Products

Cryptomator For Android

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32317.json · Exploit
• https://github.com/cryptomator/android/security/advisories/GHSA-876q-q3mm-fcvj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32317 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32317 · Security Note
• https://github.com/cryptomator/android/releases/tag/1.12.3 · Note
• https://twitter.com/CVEnew/status/2035619777935499353 · Twitter Post