Super Productivity
Monthly
Cleartext transmission and storage of private task content and connected issue-provider credentials in Super Productivity 17.3.0 through 18.13.0 occurs because the SuperSync end-to-end-encryption setup invokes sync(true) before the user has set an encryption password, so the operation-upload path pushes and persists all operations in plaintext. Affected data can include reusable issue-provider passwords, API tokens, and app passwords in addition to task text; users who finish E2EE setup have the plaintext operations deleted, but users who abandon the password-setting step can leave that data stored on the sync backend indefinitely, and the Disable SuperSync action does not remove plaintext already uploaded. Exploitation is not confirmed as actively exploited and no public exploit code has been identified at time of analysis; realizing the exposure requires the incomplete-setup condition plus read access to the server-side sync storage or the user's sync account, consistent with an authenticated (PR:H) attacker and attack-requirements-present (AT:P) profile. This is a genuine but moderate-priority confidentiality flaw, and the available signals are internally consistent rather than conflicting.
Cleartext transmission and storage of private task content and connected issue-provider credentials in Super Productivity 17.3.0 through 18.13.0 occurs because the SuperSync end-to-end-encryption setup invokes sync(true) before the user has set an encryption password, so the operation-upload path pushes and persists all operations in plaintext. Affected data can include reusable issue-provider passwords, API tokens, and app passwords in addition to task text; users who finish E2EE setup have the plaintext operations deleted, but users who abandon the password-setting step can leave that data stored on the sync backend indefinitely, and the Disable SuperSync action does not remove plaintext already uploaded. Exploitation is not confirmed as actively exploited and no public exploit code has been identified at time of analysis; realizing the exposure requires the incomplete-setup condition plus read access to the server-side sync storage or the user's sync account, consistent with an authenticated (PR:H) attacker and attack-requirements-present (AT:P) profile. This is a genuine but moderate-priority confidentiality flaw, and the available signals are internally consistent rather than conflicting.