CVE-2026-102539

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-102539
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102539.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-102539
Aliases
  • GHSA-9v8x-68pf-p5x7
Published
2026-10-12T21:22:04Z
Modified
2026-10-14T02:46:04Z
Severity
  • 5.7 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Super Productivity: SuperSync E2EE setup uploads and stores all user operations in plaintext before password is set
Details

Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. From 17.3.0 until 18.13.1, the SuperSync end-to-end encryption setup calls sync(true) before a user sets an encryption password, causing the operation-upload path to transmit and store all user operations in plaintext. The exposed operations can include private task content and connected issue-provider credentials, including reusable passwords, API tokens, and app passwords. Users who complete E2EE setup have the plaintext operations deleted, while users who leave the password-setting step can leave the data stored indefinitely. The Disable SuperSync action did not remove plaintext that had already been uploaded. Routing and causal metadata remain plaintext by design and are not part of this vulnerability. This issue is fixed in version 18.13.1.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-312",
        "CWE-693"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102539.json"
}
References

Affected packages

Git / github.com/super-productivity/super-productivity

Affected ranges

Type
GIT
Repo
https://github.com/super-productivity/super-productivity
Events
Introduced
f08b24502db0b2c68ca44a8ec57f1acd3621bae7
Fixed
63253f8e0c3b145f2d47f819ab8f910d6873fd88
Fixed
5c9c0c2131432e8729c88b3627c668923c46dc0a
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "17.3.0"
        },
        {
            "fixed":  "18.13.1"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102539.json"