What is the CVSS score of CVE-2026-32303?

CVE-2026-32303 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Cryptomator are affected by CVE-2026-32303?

Cryptomator versions before 1.19.1 suffer from a configuration integrity flaw that allows attackers with file modification capability to perform man-in-the-middle attacks against Hub-backed vaults,…. A patch is available.

How to fix or mitigate CVE-2026-32303?

Within 24 hours: Inventory all Cryptomator deployments and identify instances running versions prior to 1.19.1. Within 7 days: Deploy Cryptomator 1.19.1 or later across all affected systems; verify vault configuration files are protected against unauthorized modification with appropriate file system permissions. Within 30 days: Audit recent vault access logs for suspicious authentication endpoints and reset access tokens for all Hub-connected vaults as a precautionary measure.

Cryptomator CVE-2026-32303

EUVD-2026-13746 HIGH

Origin Validation Error (CWE-346)

2026-03-20 GitHub_M

Information Disclosure Hashicorp Cryptomator

7.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.6 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:19 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

1.19.1

EUVD ID Assigned

Mar 20, 2026 - 18:15 euvd

EUVD-2026-13746

Analysis Generated

Mar 20, 2026 - 18:15 vuln.today

CVE Published

Mar 20, 2026 - 17:57 nvd

HIGH 7.6

DescriptionGitHub Advisory

Cryptomator encrypts data being stored on cloud infrastructure. Prior to version 1.19.1, an integrity check vulnerability allows an attacker to tamper with the vault configuration file leading to a man-in-the-middle vulnerability in Hub key loading mechanism. Before this fix, the client trusted endpoints from the vault config without host authenticity checks, which could allow token exfiltration by mixing a legitimate auth endpoint with a malicious API endpoint. Impacted are users unlocking Hub-backed vaults with affected client versions in environments where an attacker can alter the vault.cryptomator file. This issue has been patched in version 1.19.1.

AnalysisAI

Cryptomator versions prior to 1.19.1 contain an integrity check vulnerability that allows attackers to tamper with the vault.cryptomator configuration file, enabling man-in-the-middle attacks during Hub key loading. Attackers can mix legitimate authentication endpoints with malicious API endpoints to exfiltrate access tokens from users unlocking Hub-backed vaults in environments where vault configuration files can be modified. The CVSS score of 7.6 indicates high severity with network attack vector requiring low privileges and user interaction, though no active exploitation (KEV) or public POC has been reported at this time.

Technical ContextAI

This vulnerability affects Cryptomator (cpe:2.3:a:cryptomator:cryptomator:*:*:*:*:*:*:*:*), a client-side encryption application for cloud storage that uses a Hub authentication mechanism for vault access. The root cause is CWE-346 (Origin Validation Error), where the application fails to perform proper host authenticity checks when processing endpoints specified in the vault.cryptomator configuration file. The client trusts configuration data without integrity validation, allowing an attacker who can modify this file to redirect API calls to attacker-controlled endpoints while maintaining legitimate authentication endpoints, creating a split-endpoint man-in-the-middle scenario that bypasses expected security boundaries.

RemediationAI

Upgrade Cryptomator to version 1.19.1 or later, as documented in the release notes at https://github.com/cryptomator/cryptomator/releases/tag/1.19.1 and patched via commit 6b82abcd80449a30b561d823193f9ecea542a625 available at https://github.com/cryptomator/cryptomator/commit/6b82abcd80449a30b561d823193f9ecea542a625. Until patching is possible, users should ensure vault.cryptomator configuration files are stored in locations with strict access controls and monitor for unauthorized modifications, verify the integrity of vault configuration files before unlocking Hub-backed vaults, and consider temporarily switching to password-based vault unlocking instead of Hub authentication in untrusted environments. Review the complete security advisory at https://github.com/cryptomator/cryptomator/security/advisories/GHSA-34rf-rwr3-7g43 for additional context and detection guidance.