← Vulnerability feed

Vulnerability record · CVE-2023-39520 · published 7 August 2023

CVE-2023-39520: Cryptomator improper privilege management vulnerability

Cryptomator · Cryptomator

Cryptomator encrypts data being stored on cloud infrastructure. The MSI installer provided on the homepage for Cryptomator version 1.9.2 allows local privilege escalation for low privileged users, via the `repair` function. The problem occurs as the repair function of the MSI is spawning an SYSTEM Powershell without the `-NoProfile` parameter. Therefore the profile of the user starting the repair will be loaded. Version 1.9.3 contains a fix for this issue. Adding a `-NoProfile` to the powershell is a possible workaround.

7.8 CVSS 3.1 High EPSS 0.33% · top 76.5% CWE-269 · Improper privilege management
7.8CVSS 3.1 base score
0.33%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

Cryptomator encrypts data being stored on cloud infrastructure. The MSI installer provided on the homepage for Cryptomator version 1.9.2 allows local privilege escalation for low privileged users, via the `repair` function. The problem occurs as the repair function of the MSI is spawning an SYSTEM Powershell without the `-NoProfile` parameter. Therefore the profile of the user starting the repair will be loaded. Version 1.9.3 contains a fix for this issue. Adding a `-NoProfile` to the powershell is a possible workaround.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/cryptomator/cryptomator/commit/727c32ad50c3901a6144a11cf984a3b7ebcf8b2b Patch
https://github.com/cryptomator/cryptomator/releases/download/1.9.2/Cryptomator-1.9.2-x64.msi Product
https://github.com/cryptomator/cryptomator/releases/tag/1.9.3 Release Notes
https://github.com/cryptomator/cryptomator/security/advisories/GHSA-62gx-54j7-mjh3 ExploitMitigationVendor Advisory
https://github.com/cryptomator/cryptomator/commit/727c32ad50c3901a6144a11cf984a3b7ebcf8b2b Patch
https://github.com/cryptomator/cryptomator/releases/download/1.9.2/Cryptomator-1.9.2-x64.msi Product
https://github.com/cryptomator/cryptomator/releases/tag/1.9.3 Release Notes
https://github.com/cryptomator/cryptomator/security/advisories/GHSA-62gx-54j7-mjh3 ExploitMitigationVendor Advisory

Track CVE-2023-39520 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.7CVE-2026-32309Cryptomator cleartext transmission vulnerabilityCryptomator encrypts data being stored on cloud infrastructure. Prior to version 1.19.1, the Hub-based unlock flow explicitly supports hub+http and c…EPSS 0.27%7.8CVE-2023-37907Cryptomator improper privilege management vulnerabilityCryptomator is data encryption software for users who store their files in the cloud. Prior to version 1.9.2, the MSI installer provided on the homep…EPSS 0.20%7.8CVE-2022-25366Cryptomator untrusted search path vulnerabilityCryptomator through 1.6.5 allows DYLIB injection because, although it has the flag 0x1000 for Hardened Runtime, it has the com.apple.security.cs.disa…EPSS 0.56%5.9CVE-2026-32317Cryptomator origin validation error vulnerabilityCryptomator for Android offers multi-platform transparent client-side encryption for files in the cloud. Prior to version 1.12.3, an integrity check …EPSS 0.08%5.9CVE-2026-32318Cryptomator origin validation error vulnerabilityCryptomator for IOS offers multi-platform transparent client-side encryption for files in the cloud. Prior to version 2.8.3, an integrity check vulne…EPSS 0.11%5.9CVE-2026-32303Cryptomator origin validation error vulnerabilityCryptomator encrypts data being stored on cloud infrastructure. Prior to version 1.19.1, an integrity check vulnerability allows an attacker to tampe…EPSS 0.16%5.3CVE-2026-32310Cryptomator path traversal vulnerabilityCryptomator encrypts data being stored on cloud infrastructure. From version 1.6.0 to before version 1.19.1, vault configuration is parsed before its…EPSS 0.36%5.3CVE-2026-29110Cryptomator error message information leak vulnerabilityCryptomator encrypts data being stored on cloud infrastructure. Prior to version 1.19.0, in non-debug mode Cryptomator might leak cleartext paths int…EPSS 0.20%

Source: NIST National Vulnerability Database (record CVE-2023-39520), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.