An integrity check vulnerability in Cryptomator versions prior to 1.19.1 exposes user vaults to token exfiltration via man-in-the-middle attacks.

This vulnerability involves an origin validation error and improper integrity checking where the client fails to verify host authenticity for Hub key loading. An attacker with the ability to modify the vault.cryptomator configuration file can trick the application into communicating with a malicious API endpoint, facilitating token exfiltration.

The exploitation of this vulnerability could lead to the unauthorized exfiltration of sensitive authentication tokens, potentially granting attackers access to encrypted cloud-stored data. With a CVSS score of 7.6, this is a high-severity issue that threatens the confidentiality of sensitive information. Failure to remediate could result in significant data breaches and a loss of user trust in the security of the vault infrastructure.

Immediate Action: Update the Cryptomator desktop client to version 1.19.1 or later to implement the required host authenticity checks.

Proactive Monitoring: Audit environment access logs for unauthorized modifications to vault configuration files, specifically the vault.cryptomator file.

Compensating Controls: Ensure that vault configuration files are stored in write-protected directories or on secure, access-controlled storage volumes to prevent unauthorized tampering.

Public Exploit Available: No

Given the high CVSS score and the direct impact on data privacy, organizations and individual users should prioritize upgrading to version 1.19.1 immediately. This update resolves the underlying trust issue in the Hub key loading mechanism and prevents the described man-in-the-middle attack vector. Consistent auditing of access controls for configuration files is strongly recommended to maintain long-term security.