CVE-2026-32318 Cryptomator for IOS: Tampered vault configuration allows MITM attack on Hub API

High 7.6 Published 20 Mar 2026 Updated 20 Mar 2026

Attackers can perform man-in-the-middle attacks on Hub API by tampering with vault configuration, leading to token exfiltration and unauthorized access.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2026-32318?

CVE-2026-32318 is a high-severity missing authorization vulnerability in cryptomator ios, published on 20 Mar 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Cryptomator for IOS offers multi-platform transparent client-side encryption for files in the cloud. Prior to version 2.8.3, an integrity check vulnerability allows an attacker tamper with the vault configuration file leading to a man-in-the-middle vulnerability in Hub key loading mechanism. Before this fix, the client trusted endpoints from the vault config without host authenticity checks, which could allow token exfiltration by mixing a legitimate auth endpoint with a malicious API endpoint. Impacted are users unlocking Hub-backed vaults with affected client versions in environments where an attacker can alter the vault.cryptomator file. This issue has been patched in version 2.8.3.

Weakness: CWE-923, CWE-451, CWE-354, CWE-346

Which versions are affected by CVE-2026-32318?

It affects 1 product.

Products include Cryptomator Cryptomator.

How do I fix CVE-2026-32318?

No fix has been published for CVE-2026-32318 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-32318 being exploited?

There is no known exploitation of CVE-2026-32318 in the wild and no public exploit code.

Sources

Also known as GHSA-g7fr-c82r-hm6j.