CVE-2026-102539

Received Received - Intake

Information Disclosure in Super Productivity

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: GitHub, Inc.

Description

Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. From 17.3.0 until 18.13.1, the SuperSync end-to-end encryption setup calls sync(true) before a user sets an encryption password, causing the operation-upload path to transmit and store all user operations in plaintext. The exposed operations can include private task content and connected issue-provider credentials, including reusable passwords, API tokens, and app passwords. Users who complete E2EE setup have the plaintext operations deleted, while users who leave the password-setting step can leave the data stored indefinitely. The Disable SuperSync action did not remove plaintext that had already been uploaded. Routing and causal metadata remain plaintext by design and are not part of this vulnerability. This issue is fixed in version 18.13.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-102539

Affected Vendors & Products

Vendor	Product	Version / Range
super-productivity	super-productivity	>= 17.3.0, < 18.13.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-312	The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
CWE-693	The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

Executive Summary

This vulnerability affects Super Productivity, a todo list app with time tracking. Between versions 17.3.0 and 18.13.1, the app's end-to-end encryption setup incorrectly called sync(true) before users set an encryption password. This caused user operations, including private task content and credentials like API tokens, to be transmitted and stored in plaintext. The issue was fixed in version 18.13.1.

Detection Guidance

Check if your Super Productivity version is between 17.3.0 and 18.13.0. Review network traffic for unencrypted data transmission during sync operations. Inspect stored operations for plaintext task content or credentials.

Impact Analysis

If you used versions 17.3.0 to 18.13.1, your private task content and credentials such as API tokens or passwords may have been exposed. Even if you later set up encryption, plaintext data could remain stored indefinitely if you skipped the password step. The Disable SuperSync feature did not remove already uploaded plaintext data.

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations like GDPR or HIPAA due to unauthorized exposure of sensitive user data, including personal tasks and credentials. Organizations using affected versions may face legal and regulatory penalties for failing to protect user information.

Mitigation Strategies

Upgrade to version 18.13.1 or later. If already upgraded, verify plaintext data was deleted. Disable SuperSync if not needed. Rotate any exposed API tokens or passwords.

Hi! I’m here to help you understand CVE-2026-102539. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70