CVE-2026-32317

Katalog CVE

CVSS 5.9 · Medium EPSS 0,08%

Kerentanan Origin Validation Error pada cryptomator. Skor CVSS 3.1 5.9 (Medium) menurut NVD.

Deskripsi (NVD)

Cryptomator for Android offers multi-platform transparent client-side encryption for files in the cloud. Prior to version 1.12.3, an integrity check vulnerability allows an attacker tamper with the vault configuration file leading to a man-in-the-middle vulnerability in Hub key loading mechanism. Before this fix, the client trusted endpoints from the vault config without host authenticity checks, which could allow token exfiltration by mixing a legitimate auth endpoint with a malicious API endpoint. Impacted are users unlocking Hub-backed vaults with affected client versions in environments where an attacker can alter the vault.cryptomator file. This issue has been patched in version 1.12.3.

Rincian

Terbit di NVD

20 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-346: Origin Validation Error
CWE-354: Improper Validation of Integrity Check Value
CWE-451: User Interface (UI) Misrepresentation of Critical Information
CWE-923: Improper Restriction of Communication Channel to Intended Endpoints

EPSS (30 hari)

0,08% peluang dieksploitasi; lebih tinggi dari 0,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/cryptomator/android/security/advisories/GHSA-876q-q3mm-fcvj advisory vendor
• https://github.com/cryptomator/android/releases/tag/1.12.3 release notes