Mindwtr
Monthly
Mindwtr mobile versions prior to 1.1.5 persist the Cloud sync bearer token and WebDAV password as plaintext in React Native AsyncStorage (@mindwtr_cloud_token and @mindwtr_webdav_password), allowing anyone who can read the app's private storage - via a rooted/jailbroken or physically possessed device, or an unencrypted device backup that captures AsyncStorage - to recover those credentials and reach the user's synchronized tasks and attachments. Per the CVSS vector (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, base 4.4), this is a locally-scoped, high-privilege information disclosure with no remote or network vector and no user interaction; only users who actually enabled self-hosted Cloud sync or WebDAV sync in an affected build are exposed. There is no public exploit code identified and no CISA KEV listing - this is a low-to-moderate local credential-at-rest weakness rather than an urgent remote threat, and it is fixed in version 1.1.5.
Mindwtr mobile versions prior to 1.1.5 persist the Cloud sync bearer token and WebDAV password as plaintext in React Native AsyncStorage (@mindwtr_cloud_token and @mindwtr_webdav_password), allowing anyone who can read the app's private storage - via a rooted/jailbroken or physically possessed device, or an unencrypted device backup that captures AsyncStorage - to recover those credentials and reach the user's synchronized tasks and attachments. Per the CVSS vector (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, base 4.4), this is a locally-scoped, high-privilege information disclosure with no remote or network vector and no user interaction; only users who actually enabled self-hosted Cloud sync or WebDAV sync in an affected build are exposed. There is no public exploit code identified and no CISA KEV listing - this is a low-to-moderate local credential-at-rest weakness rather than an urgent remote threat, and it is fixed in version 1.1.5.