What is the CVSS score of CVE-2026-32318?

CVE-2026-32318 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of iOS are affected by CVE-2026-32318?

Cryptomator for iOS versions before 2.8.3 contain a man-in-the-middle vulnerability that allows attackers with file system write access to intercept authentication tokens by modifying vault…. A patch is available.

How to fix or mitigate CVE-2026-32318?

Within 24 hours: Identify all iOS devices running Cryptomator versions prior to 2.8.3 within your organization. Within 7 days: Deploy Cryptomator for iOS version 2.8.3 or later to all affected devices via MDM or direct user notification. Within 30 days: Audit vault configuration file access controls across all systems hosting Cryptomator vaults to ensure write permissions are restricted to authorized users only.

iOS CVE-2026-32318

EUVD-2026-13762 HIGH

Origin Validation Error (CWE-346)

2026-03-20 GitHub_M

Information Disclosure Hashicorp Apple iOS

7.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.6 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:19 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

2.8.3

EUVD ID Assigned

Mar 20, 2026 - 18:46 euvd

EUVD-2026-13762

Analysis Generated

Mar 20, 2026 - 18:46 vuln.today

CVE Published

Mar 20, 2026 - 18:27 nvd

HIGH 7.6

DescriptionGitHub Advisory

Cryptomator for IOS offers multi-platform transparent client-side encryption for files in the cloud. Prior to version 2.8.3, an integrity check vulnerability allows an attacker tamper with the vault configuration file leading to a man-in-the-middle vulnerability in Hub key loading mechanism. Before this fix, the client trusted endpoints from the vault config without host authenticity checks, which could allow token exfiltration by mixing a legitimate auth endpoint with a malicious API endpoint. Impacted are users unlocking Hub-backed vaults with affected client versions in environments where an attacker can alter the vault.cryptomator file. This issue has been patched in version 2.8.3.

AnalysisAI

A man-in-the-middle vulnerability in Cryptomator for iOS versions prior to 2.8.3 allows attackers who can modify the vault.cryptomator configuration file to intercept authentication tokens by substituting malicious API endpoints while maintaining legitimate authentication endpoints. This affects users unlocking Hub-backed vaults in environments where attackers have write access to vault configuration files. No evidence of active exploitation (not in CISA KEV) has been reported, and patches are available.

Technical ContextAI

Cryptomator for iOS (cpe:2.3:a:cryptomator:ios:*:*:*:*:*:*:*:*) is a client-side encryption application for cloud storage that supports Hub-backed vault authentication. The vulnerability stems from CWE-346 (Origin Validation Error), where the application failed to perform host authenticity checks on endpoints specified in the vault.cryptomator configuration file. When loading Hub keys, the client would trust endpoint URLs from the configuration without validation, allowing an attacker to specify a legitimate OAuth authentication endpoint to complete the user authentication flow while redirecting API calls to an attacker-controlled server to exfiltrate tokens. This represents a classic trust boundary violation where external configuration data was treated as trusted input without integrity verification.

RemediationAI

Upgrade Cryptomator for iOS to version 2.8.3 or later, which implements proper host authenticity checks for Hub endpoints as documented in the vendor advisory at https://github.com/cryptomator/ios/security/advisories/GHSA-g7fr-c82r-hm6j and release notes at https://github.com/cryptomator/ios/releases/tag/2.8.3. The fix is implemented in commit 98c31280304af65c0932eb547d5fe4be2d16929c and pull request https://github.com/cryptomator/ios/pull/444. As a temporary mitigation until patching is possible, organizations should implement file integrity monitoring on vault.cryptomator configuration files, restrict write access to vault storage locations, and consider disabling Hub-backed vault access on unpatched clients until the update can be deployed.