Log in Start free

Vulnerability · Published Mar 20, 2026 · Assigned by GitHub_M

CVE-2026-32303Cryptomator: Tampered vault configuration allows MITM attack on Hub API

High 7.6

In plain English

A high-severity security flaw in cryptomator from cryptomator. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).

Severity (CVSS 3.1)7.6High
Exploit odds (30 days)0.1%top 98.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Cryptomator encrypts data being stored on cloud infrastructure. Prior to version 1.19.1, an integrity check vulnerability allows an attacker to tamper with the vault configuration file leading to a man-in-the-middle vulnerability in Hub key loading mechanism. Before this fix, the client trusted endpoints from the vault config without host authenticity checks, which could allow token exfiltration by mixing a legitimate auth endpoint with a malicious API endpoint. Impacted are users unlocking Hub-backed vaults with affected client versions in environments where an attacker can alter the vault.cryptomator file. This issue has been patched in version 1.19.1.

Affected products (as reported)

VendorProductVersions
cryptomator cryptomator < 1.19.1

Weakness: CWE-346, CWE-354, CWE-451, CWE-923 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

References