CVE-2026-33472

OVERVIEW CVE-2026-33472 is a logic flaw in Cryptomator version 1.19.1, an open-source client-side encryption application for cloud storage. The vulnerability exists in the CheckHostTrustController.getAuthority() method, which hardcodes URI schemes based on port numbers rather than explicit protocol specifications. This design flaw allows attackers to bypass the security fix implemented for CVE-2026-32303, creating a pathway for unauthorized vault access. SEVERITY The vulnerability carries a CVSS 3.1 score of 4.8 (MEDIUM) with a network-based attack vector, high complexity, and low privileges required. Exploitation requires user interaction and write access to a cloud-synced vault configuration file. While the confidentiality impact is rated as HIGH, the attack involves intercepting OAuth token exchanges through network positioning, making practical exploitation technically demanding. The EPSS score of 0.00008 indicates minimal real-world prevalence compared to other disclosed vulnerabilities. EXPLOITATION STATUS There is no evidence of active exploitation. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog, and no public exploit code is available. Community attention remains low, as indicated by the Inactive status on security tracking platforms. Cryptomator addressed the issue promptly in version 1.19.2, and users with updated installations face no risk from this flaw.