What is the CVSS score of CVE-2026-32317?

CVE-2026-32317 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Android are affected by CVE-2026-32317?

Cryptomator for Android versions prior to 1.12.3 contain an integrity check vulnerability that allows attackers to tamper with vault configuration files and redirect authentication requests to…. A patch is available.

How to fix or mitigate CVE-2026-32317?

Within 24 hours: Identify all Cryptomator for Android deployments and current version inventory. Within 7 days: Deploy Cryptomator for Android version 1.12.3 or later to all affected mobile devices via mobile device management (MDM) or app store enforcement. Within 30 days: Conduct audit of Hub-backed vault access logs for suspicious authentication patterns and rotate tokens of high-risk user accounts.

Android CVE-2026-32317

EUVD-2026-13760 HIGH

Origin Validation Error (CWE-346)

2026-03-20 GitHub_M

Information Disclosure Google Hashicorp Android

7.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.6 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:19 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

1.12.3

EUVD ID Assigned

Mar 20, 2026 - 18:46 euvd

EUVD-2026-13760

Analysis Generated

Mar 20, 2026 - 18:46 vuln.today

CVE Published

Mar 20, 2026 - 18:29 nvd

HIGH 7.6

DescriptionGitHub Advisory

Cryptomator for Android offers multi-platform transparent client-side encryption for files in the cloud. Prior to version 1.12.3, an integrity check vulnerability allows an attacker tamper with the vault configuration file leading to a man-in-the-middle vulnerability in Hub key loading mechanism. Before this fix, the client trusted endpoints from the vault config without host authenticity checks, which could allow token exfiltration by mixing a legitimate auth endpoint with a malicious API endpoint. Impacted are users unlocking Hub-backed vaults with affected client versions in environments where an attacker can alter the vault.cryptomator file. This issue has been patched in version 1.12.3.

AnalysisAI

An integrity check vulnerability in Cryptomator for Android prior to version 1.12.3 allows attackers to tamper with the vault configuration file, enabling a man-in-the-middle attack against the Hub key loading mechanism. Attackers who can modify the vault.cryptomator file can mix legitimate authentication endpoints with malicious API endpoints to exfiltrate tokens from users unlocking Hub-backed vaults. With a CVSS score of 7.6 and requiring low attack complexity with user interaction, this vulnerability poses a moderate risk to affected users in environments where vault configuration files can be altered.

Technical ContextAI

This vulnerability affects Cryptomator for Android (cpe:2.3:a:cryptomator:android:*:*:*:*:*:*:*:*), a client-side encryption application that provides transparent file encryption for cloud storage platforms including Google-based services. The root cause is classified as CWE-346 (Origin Validation Error), where the application fails to perform proper host authenticity checks when loading endpoints from the vault configuration file. Before version 1.12.3, the client implicitly trusted the endpoints specified in vault.cryptomator without validating that both authentication and API endpoints belonged to legitimate, trusted hosts. This allows an attacker to substitute API endpoints while maintaining legitimate authentication endpoints, creating a split trust model that can be exploited for credential theft during Hub-backed vault operations.

RemediationAI

Upgrade Cryptomator for Android to version 1.12.3 or later, which includes patches for the vault configuration integrity check and implements proper host authenticity validation (release notes available at https://github.com/cryptomator/android/releases/tag/1.12.3). Until patching is feasible, users should ensure vault.cryptomator files are stored in trusted locations with restricted write access and avoid unlocking Hub-backed vaults when operating on untrusted networks or using potentially compromised cloud storage providers. Organizations should audit access controls on vault configuration files and implement file integrity monitoring to detect unauthorized modifications to vault.cryptomator files in shared or cloud-based storage environments.