Vulnerability DatabaseCVE-2026-73230
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2026-73230
Published:August 11, 2026
Updated:August 31, 2026
Ente provides end-to-end encrypted cloud services and security tools. Prior to 2026.07.28, Ente 2of3 card format version 1 stored the secret byte length and 32-bit FNV-1a checksum in cleartext on every card, allowing someone with one card to test candidate secrets offline and recover low-entropy or predictable secrets. This issue is fixed in version 2026.07.28.
Affected Packages
https://github.com/ente/ente.git (GITHUB):
Affected version(s) >=locker-v1.0.5 <locker-v1.0.8
Fix Suggestion:
Update to version locker-v1.0.8
Related Resources (6)
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73230.json
https://github.com/ente/ente/pull/11729
https://nvd.nist.gov/vuln/detail/CVE-2026-73230
https://github.com/ente/ente/security/advisories/GHSA-v6x7-rrch-9q9w
https://github.com/ente/ente/commit/c3d2e400ae6fa66d5ce7df422136d28805fe1442
https://github.com/ente/ente/commit/6681d8370a37c2fc745d3098126ba1ee62bf06a5
Do you need more information?
Contact Us
CVSS v4
Base Score:
5.9
Attack Vector
LOCAL
Attack Complexity
HIGH
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
NONE
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
5.1
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE
Weakness Type (CWE)
Exposure of Sensitive Information to an Unauthorized Actor
CWE-200
EPSS
Base Score:
0.13