CVE-2026-102539

Name of the Vulnerable Software and Affected Versions Super Productivity versions 17.3.0 through 18.13.0

Description The SuperSync end-to-end encryption (E2EE) setup calls the sync(true) function before a user defines an encryption password. This causes the operation-upload path to transmit and store user operations in plaintext. Exposed data may include private task content and connected issue-provider credentials, such as API tokens, app passwords, and reusable passwords. While users who complete the E2EE setup have their plaintext operations deleted, those who exit during the password-setting step may have their data stored indefinitely. Additionally, the Disable SuperSync action does not remove previously uploaded plaintext data.

Recommendations Update to version 18.13.1.