CVE-2026-32303

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-32303
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32303.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-32303
Aliases
  • GHSA-34rf-rwr3-7g43
Published
2026-03-20T17:57:31.884Z
Modified
2026-04-10T05:42:22.356829Z
Severity
  • 7.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N CVSS Calculator
Summary
Cryptomator: Tampered vault configuration allows MITM attack on Hub API
Details

Cryptomator encrypts data being stored on cloud infrastructure. Prior to version 1.19.1, an integrity check vulnerability allows an attacker to tamper with the vault configuration file leading to a man-in-the-middle vulnerability in Hub key loading mechanism. Before this fix, the client trusted endpoints from the vault config without host authenticity checks, which could allow token exfiltration by mixing a legitimate auth endpoint with a malicious API endpoint. Impacted are users unlocking Hub-backed vaults with affected client versions in environments where an attacker can alter the vault.cryptomator file. This issue has been patched in version 1.19.1.

Database specific 
{
    "cwe_ids": [
        "CWE-346",
        "CWE-354",
        "CWE-451",
        "CWE-923"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32303.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/cryptomator/cryptomator

Affected ranges

Type
GIT
Repo
https://github.com/cryptomator/cryptomator
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6b82abcd80449a30b561d823193f9ecea542a625
Type
GIT
Repo
https://github.com/cryptomator/cryptomator
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
4be327608a6d478d5d9055121f0ab28fd649b864

Affected versions

0.*
0.10.0
0.11.0
0.3.0
0.4.0
0.5.0
0.5.1
0.6.0
0.7.0
0.7.1
0.8.0
0.8.1
0.9.0
1.*
1.0.0
1.0.1
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.10.0
1.10.1
1.11.0
1.11.1
1.12.0
1.12.1
1.12.2
1.12.3
1.12.3-beta1
1.12.4
1.13.0
1.14.0
1.14.1
1.14.2
1.15.0
1.15.1
1.15.2
1.15.3
1.16.0
1.16.1
1.16.2
1.17.0
1.17.1
1.18.0
1.18.1
1.19.0
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.3.0
1.3.0-rc1
1.3.0-rc2
1.3.0-rc3
1.3.0-rc4
1.3.0-rc5
1.3.0-rc6
1.3.0-rc7
1.3.0-rc8
1.3.0-rc9
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.4.0
1.4.0-beta1
1.4.0-beta2
1.4.0-beta3
1.4.0-rc1
1.4.1
1.4.10
1.4.11
1.4.12
1.4.13
1.4.14
1.4.15
1.4.16
1.4.2
1.4.3
1.4.4
1.4.5
1.4.5-beta1
1.4.6
1.4.6-beta1
1.4.7
1.4.8
1.4.9
1.5.0
1.5.0-alpha1
1.5.0-alpha2
1.5.0-beta1
1.5.0-beta2
1.5.0-beta3
1.5.1
1.5.10
1.5.11
1.5.12
1.5.13
1.5.14
1.5.15
1.5.16
1.5.17
1.5.18
1.5.19
1.5.2
1.5.3
1.5.4
1.5.5
1.5.6
1.5.7
1.5.8
1.5.9
1.6.0
1.6.1
1.6.10
1.6.11
1.6.12
1.6.13
1.6.14
1.6.15
1.6.16
1.6.17
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.7.0
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.8.0
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
Other
continuous
nightly

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32303.json"