Mindwtr CVE-2026-107857

Requires that the victim has actually configured mobile sync - either self-hosted Cloud sync (producing @mindwtr_cloud_token) or WebDAV sync (producing @mindwtr_webdav_password) - in a Mindwtr mobile version prior to 1.1.5, so that a credential exists in AsyncStorage at all. Exploitation then requires local access to the app's private storage/database (e.g., a rooted/jailbroken or physically possessed device) OR access to an unencrypted device backup that includes the app's AsyncStorage. Limiting factors: no remote or network vector, no user interaction, and no exposure for users who never enabled sync or who store device backups encrypted; the attacker must already hold the device or its backup.

This is a low-to-moderate, locally-scoped information disclosure issue (CWE-312, cleartext storage of credentials), not an urgent priority. The provided CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, base 4.4) is internally consistent with the description: exploitation requires local access to the app's private storage or an exposed device backup, not network reach, and yields only a confidentiality impact (recovered sync credentials). No EPSS score, KEV listing, or POC was provided in the input, so there is no signal of active or probable exploitation - absence of these is expected for a niche product and should not be read as either safe or exploited. The signals are concordant rather than conflicting: a genuinely local, high-privilege-prerequisite flaw with high confidentiality impact but no remote or automatable component. The one nuance worth flagging is PR:H - the attacker does not authenticate to Mindwtr itself but must already possess elevated access to the device sandbox or an unprotected backup, which the vector models as high privilege; this is a precondition, not an in-app authentication step, so defenders should read it as 'requires prior device/backup compromise.' Overall this is a 'high-CWE-severity-but-low-real-world-urgency' issue for most users, elevated only where device backups are unencrypted or devices are shared/lost.

A user configures Mindwtr mobile sync (self-hosted Cloud or WebDAV), causing a bearer token or WebDAV password to be stored in cleartext in AsyncStorage. An attacker who later obtains the device, roots/jailbreaks it, or recovers an unencrypted device backup reads @mindwtr_cloud_token or @mindwtr_webdav_password directly and uses the credential to log into the sync server and exfiltrate the victim's tasks and attachments. No public exploit identified at time of analysis; no special tooling is needed beyond standard file/backup inspection.