Mindwtr: Cloud token and WebDAV password stored in plaintext on mobile

published 2026-10-09 30 d ago modified 2026-10-16 23 d ago also EUVD-2026-95985

cvss: 4.4; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.1%; EPSS 0.1% chance of exploitation in 30 days, percentile 0%
public exploits: 0; none known

Mindwtr is a free offline-first task management application for desktop and mobile. Prior to 1.1.5, the mobile application writes the Cloud sync bearer token and WebDAV password to unencrypted AsyncStorage under @mindwtr_cloud_token and @mindwtr_webdav_password. A party with access to the application database or an exposed device backup can recover these credentials and use them to access the user's synchronized tasks and attachments. This issue is fixed in version 1.1.5.

Patch / fix

links 2

github.com/dongdongbh/Mindwtr@b30f568 commit
github.com/dongdongbh/Mindwtr/releases/tag/v1.1.5 release

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 26 d ago (2026-10-13)

Exploit prediction

0.09% chance of exploitation in the next 30 days, higher than 0% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	4.4	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Affected products

dongdongbh Mindwtr

Classification

Weakness

CWE-312 Cleartext Storage of Sensitive Information
CWE-522 Insufficiently Protected Credentials

References

Sources

CVE List CVE-2026-107857
NVD CVE-2026-107857

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary