Advisories · Technology

cryptomator.

Every CVE that names cryptomator among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-33472 CVE record

CVSS 4.8 Medium

Cryptomator Hub OAuth token exchange HTTP downgrade via getAuthority() scheme confusion (CVE-2026-32303 bypass)
- cryptomator
- Weak cryptography or TLS
- CWE-305
Not analysed yet 16 Apr 2026
CVE-2026-32310 CVE record

CVSS 4.1 Medium

Cryptomator: Unverified masterkeyfile key IDs can access arbitrary local or UNC paths
- cryptomator
- Path traversal
Not analysed yet 20 Mar 2026
CVE-2026-32309 CVE record

CVSS 8.7 High

Cryptomator: Hub unlocking accepts plaintext HTTP and unvalidated endpoint schemes
- cryptomator
- Weak cryptography or TLS
Not analysed yet 20 Mar 2026
CVE-2026-32303 CVE record

CVSS 7.6 High

Cryptomator: Tampered vault configuration allows MITM attack on Hub API
- cryptomator
- CWE-346
- CWE-354
Not analysed yet 20 Mar 2026
CVE-2026-29110 CVE record

CVSS 2.2 Low

Cryptomator: Leaking of cleartext paths into log file in non-debug mode
- cryptomator
- Information disclosure
Not analysed yet 6 Mar 2026
CVE-2023-39520 CVE record

CVSS 5.5 Medium

Cryptomator vulnerable to Local Elevation of Privileges
- cryptomator
- Privilege escalation
Not analysed yet 7 Aug 2023
CVE-2023-37907 CVE record

CVSS 7.0 High

Cryptomator's MSI installer allows local privilege escalation
- cryptomator
- Privilege escalation
Not analysed yet 25 Jul 2023