CVE-2026-107857

Mindwtr: Cloud token and WebDAV password stored in plaintext on mobile

State: Published
Severity: 4.4 Medium
Published: Oct 9, 2026
Updated: Oct 13, 2026
Reserved: Oct 8, 2026

Description

Mindwtr is a free offline-first task management application for desktop and mobile. Prior to 1.1.5, the mobile application writes the Cloud sync bearer token and WebDAV password to unencrypted AsyncStorage under @mindwtr_cloud_token and @mindwtr_webdav_password. A party with access to the application database or an exposed device backup can recover these credentials and use them to access the user's synchronized tasks and attachments. This issue is fixed in version 1.1.5.

Scores

CVSS	Score	Vector	Source
3.1	4.4 Medium	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N	GitHub_M

Weaknesses

CWE-312 Cleartext Storage of Sensitive Information
CWE-522 Insufficiently Protected Credentials

Affected Products

Product	Versions
Mindwtrdongdongbh	< 1.1.5Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.