Super Productivity CVE-2026-102539

The product must be a vulnerable Super Productivity build (17.3.0 through 18.13.0) using SuperSync, and the user must initiate end-to-end-encryption setup but NOT complete the password-setting step - this is the exact condition that leaves plaintext operations (task content plus connected issue-provider credentials, API tokens, and app passwords) stored on the sync server indefinitely. Completing E2EE setup deletes the plaintext, so fully-configured users are not persistently exposed; however, using the Disable SuperSync action does NOT remove already-uploaded plaintext. Realizing the exposure additionally requires an actor with read access to the SuperSync server-side storage or the user's sync account/backend, since the data is uploaded to the server rather than exposed over the client network path. Routing and causal metadata are plaintext by design and are out of scope.

This is a genuine but moderate-priority confidentiality flaw, and the signals are internally consistent rather than conflicting. The vendor's CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:H/UI:P, VC:H only) scores 5.7 (Medium), and the metric choices match the description well: exploitation is not a simple remote-unauthenticated grab but depends on a specific sequence - a user begins SuperSync end-to-end-encryption setup, the client calls sync(true) before a password is set, and plaintext operations are uploaded and then left on the server because the user abandons the password step. The high-impact element is VC:H: exposed operations can include issue-provider credentials (reusable passwords, API tokens, app passwords), so the blast radius extends beyond task data to connected third-party systems. No EPSS score, CISA KEV entry, or public POC was provided in the input, so per precision rules this is 'no public exploit identified at time of analysis' - there is no evidence of active or widespread exploitation. The AT:P / PR:H / UI:P combination indicates the data only reaches the server through legitimate operator action and then requires an actor with access to the SuperSync server-side storage (or the user's sync account/backend) to read it; it is not something an arbitrary internet attacker triggers against a victim. Net: a real E2EE-promise-breaking data-at-rest exposure worth patching, but not an urgent mass-exploitation threat. One nuance worth flagging: the leak persists indefinitely for users who abandoned setup and is NOT cleaned up by the Disable SuperSync action, so remediation requires server-side data purging in addition to upgrading.

A user on a vulnerable version (17.3.0-18.13.0) opens SuperSync E2EE setup; before they choose an encryption password the client's sync(true) call uploads all local operations - including private task content and connected issue-provider credentials - to the sync server in cleartext, and the user then closes the dialog without completing setup. Because completing E2EE is what deletes the plaintext and Disable SuperSync does not remove it, the cleartext data remains stored indefinitely, where anyone with access to the SuperSync server storage or the user's sync backend can read the tasks and reuse the exposed API tokens and passwords. No public exploit code is identified; exploitation requires access to the stored server-side data rather than a remote network attack against the client.