Vulnerability Description
Cryptomator encrypts data being stored on cloud infrastructure. Prior to version 1.19.1, an integrity check vulnerability allows an attacker to tamper with the vault configuration file leading to a man-in-the-middle vulnerability in Hub key loading mechanism. Before this fix, the client trusted endpoints from the vault config without host authenticity checks, which could allow token exfiltration by mixing a legitimate auth endpoint with a malicious API endpoint. Impacted are users unlocking Hub-backed vaults with affected client versions in environments where an attacker can alter the vault.cryptomator file. This issue has been patched in version 1.19.1.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cryptomator | Cryptomator | < 1.19.1 |
Related Weaknesses (CWE)
References
- https://github.com/cryptomator/cryptomator/commit/6b82abcd80449a30b561d823193f9ePatch
- https://github.com/cryptomator/cryptomator/pull/4179Issue Tracking
- https://github.com/cryptomator/cryptomator/releases/tag/1.19.1Release Notes
- https://github.com/cryptomator/cryptomator/security/advisories/GHSA-34rf-rwr3-7gVendor Advisory
FAQ
What is CVE-2026-32303?
CVE-2026-32303 is a vulnerability with a CVSS score of 7.6 (HIGH). Cryptomator encrypts data being stored on cloud infrastructure. Prior to version 1.19.1, an integrity check vulnerability allows an attacker to tamper with the vault configuration file leading to a ma...
How severe is CVE-2026-32303?
CVE-2026-32303 has been rated HIGH with a CVSS base score of 7.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-32303?
Check the references section above for vendor advisories and patch information. Affected products include: Cryptomator Cryptomator.