CVE-2026-32317 Cryptomator for Android: Tampered vault configuration allows MITM attack on Hub API
Attackers can tamper with vault configuration to redirect API requests, enabling man-in-the-middle attacks and token exfiltration for Hub-backed vaults.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-32317?
CVE-2026-32317 is a high-severity missing authorization vulnerability in cryptomator android, published on 20 Mar 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Cryptomator for Android offers multi-platform transparent client-side encryption for files in the cloud. Prior to version 1.12.3, an integrity check vulnerability allows an attacker tamper with the vault configuration file leading to a man-in-the-middle vulnerability in Hub key loading mechanism. Before this fix, the client trusted endpoints from the vault config without host authenticity checks, which could allow token exfiltration by mixing a legitimate auth endpoint with a malicious API endpoint. Impacted are users unlocking Hub-backed vaults with affected client versions in environments where an attacker can alter the vault.cryptomator file. This issue has been patched in version 1.12.3.
Which versions are affected by CVE-2026-32317?
It affects 1 product.
Products include Cryptomator Cryptomator.
How do I fix CVE-2026-32317?
No fix has been published for CVE-2026-32317 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-32317 being exploited?
There is no known exploitation of CVE-2026-32317 in the wild and no public exploit code.
Other vulnerabilities in cryptomator android
- CVE-2026-32309 Cryptomator: Hub unlocking accepts plaintext HTTP and unvalidated endpoint schemes
- CVE-2022-25366 Code injection in n/a
- CVE-2026-32303 Cryptomator: Tampered vault configuration allows MITM attack on Hub API
- CVE-2026-32318 Cryptomator for IOS: Tampered vault configuration allows MITM attack on Hub API
- CVE-2023-37907 Cryptomator's MSI installer allows local privilege escalation
Sources
Also known as GHSA-876q-q3mm-fcvj.