CVE-2026-107857

Mindwtr is a free offline-first task management application for desktop and mobile. Prior to 1.1.5, the mobile application writes the Cloud sync bearer token and WebDAV password to unencrypted AsyncStorage under @mindwtr_cloud_token and @mindwtr_webdav_password. A party with access to the application database or an exposed device backup can recover these credentials and use them to access the user's synchronized tasks and attachments. This issue is fixed in version 1.1.5.

CVSS v3 4.4 MEDIUM

4.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/dongdongbh/Mindwtr/commit/b30f568aab753c13d11943452b32f5520712aedb
https://github.com/dongdongbh/Mindwtr/releases/tag/v1.1.5
https://github.com/dongdongbh/Mindwtr/security/advisories/GHSA-8x25-76x5-jgmr

Configurations

No configuration.

History

09 Oct 2026, 21:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-09 21:17

Updated : 2026-10-16 20:02

NVD link : CVE-2026-107857

Mitre link : CVE-2026-107857

CVE.ORG link : CVE-2026-107857

JSON object : View

Products Affected

No product.

CWE

CWE-312

Cleartext Storage of Sensitive Information

CWE-522

Insufficiently Protected Credentials

{"id": "CVE-2026-107857", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-107857", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-13T20:13:29.743459Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "dongdongbh", "product": "Mindwtr", "versions": [{"status": "affected", "version": "< 1.1.5"}]}]}], "published": "2026-10-09T21:17:03.550", "references": [{"url": "https://github.com/dongdongbh/Mindwtr/commit/b30f568aab753c13d11943452b32f5520712aedb", "source": "security-advisories@github.com"}, {"url": "https://github.com/dongdongbh/Mindwtr/releases/tag/v1.1.5", "source": "security-advisories@github.com"}, {"url": "https://github.com/dongdongbh/Mindwtr/security/advisories/GHSA-8x25-76x5-jgmr", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-312"}, {"lang": "en", "value": "CWE-522"}]}], "descriptions": [{"lang": "en", "value": "Mindwtr is a free offline-first task management application for desktop and mobile. Prior to 1.1.5, the mobile application writes the Cloud sync bearer token and WebDAV password to unencrypted AsyncStorage under @mindwtr_cloud_token and @mindwtr_webdav_password. A party with access to the application database or an exposed device backup can recover these credentials and use them to access the user's synchronized tasks and attachments. This issue is fixed in version 1.1.5."}], "lastModified": "2026-10-16T20:02:37.630", "sourceIdentifier": "security-advisories@github.com"}