CVE-2026-32303

Cryptomator encrypts data being stored on cloud infrastructure. Prior to version 1.19.1, an integrity check vulnerability allows an attacker to tamper with the vault configuration file leading to a man-in-the-middle vulnerability in Hub key loading mechanism. Before this fix, the client trusted endpoints from the vault config without host authenticity checks, which could allow token exfiltration by mixing a legitimate auth endpoint with a malicious API endpoint. Impacted are users unlocking Hub-backed vaults with affected client versions in environments where an attacker can alter the vault.cryptomator file. This issue has been patched in version 1.19.1.

• CWE-346
• CWE-354
• CWE-451
• CWE-923

• https://github.com/cryptomator/cryptomator/commit/6b82abcd80449a30b561d823193f9ecea542a625Patch
• https://github.com/cryptomator/cryptomator/pull/4179Issue Tracking
• https://github.com/cryptomator/cryptomator/releases/tag/1.19.1Release Notes
• https://github.com/cryptomator/cryptomator/security/advisories/GHSA-34rf-rwr3-7g43Vendor Advisory

Published

Mar 20, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32298The Angeet ES3 KVM does not properly sanitize user-supplied …9.1
• CVE-2026-32299Connect-CMS is a content management system. In versions on t…7.5
• CVE-2026-3230Missing required cryptographic step in the TLS 1.3 client He…2.7
• CVE-2026-32300Connect-CMS is a content management system. In versions on t…8.1
• CVE-2026-32301Centrifugo is an open-source scalable real-time messaging se…9.3
• CVE-2026-32302OpenClaw is a personal AI assistant. Prior to 2026.3.11, bro…8.1
• CVE-2026-32304Locutus brings stdlibs of other programming languages to Jav…9.8
• CVE-2026-32305Traefik is an HTTP reverse proxy and load balancer. Versions…5.3
• CVE-2026-32306OneUptime is a solution for monitoring and managing online s…9.9
• CVE-2026-32308OneUptime is a solution for monitoring and managing online s…7.6
• CVE-2026-32309Cryptomator encrypts data being stored on cloud infrastructu…7.5
• CVE-2026-3231The Checkout Field Editor (Checkout Manager) for WooCommerce…7.2