PT-2026-26660 · Cryptomator · Cryptomator For Ios

Leekiyoon-Sec · Published 2026-03-20 · Updated 2026-03-22 · CVE-2026-32318

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cryptomator for iOS versions prior to 2.8.3

Description Cryptomator for iOS provides client-side encryption for files in the cloud. A flaw in integrity checks allows tampering with the vault configuration file, potentially leading to a man-in-the-middle attack during the Hub key loading process. Previously, the client trusted endpoints from the vault configuration without verifying host authenticity, which could allow an attacker to steal authentication tokens by substituting a legitimate authentication endpoint with a malicious API endpoint. The issue impacts users unlocking Hub-backed vaults with vulnerable client versions in environments where an attacker can modify the vault.cryptomator file.

Recommendations Update to version 2.8.3 or later.

Exploit

Fix

UI Misrepresentation of Critical Information

Origin Validation Error

Weakness Enumeration

CWE-923

CWE-354

CWE-451

CWE-346

Related Identifiers

CVE-2026-32318

GHSA-G7FR-C82R-HM6J

Affected Products

Cryptomator For Ios

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32318.json · Exploit
• https://github.com/cryptomator/ios/security/advisories/GHSA-g7fr-c82r-hm6j · Vendor Advisory
• https://github.com/cryptomator/ios/commit/98c31280304af65c0932eb547d5fe4be2d16929c · Patch
• https://osv.dev/vulnerability/CVE-2026-32318 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32318 · Security Note
• https://github.com/cryptomator/ios/pull/444 · Note
• https://github.com/cryptomator/ios/releases/tag/2.8.3 · Note
• https://twitter.com/CVEnew/status/2035619778883354792 · Twitter Post