Super Productivity uploads user data in plaintext during E2EE setup
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Information disclosure, Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-312 and CWE-693.
Summary
Super Productivity from 17.3.0 before 18.13.1 is affected. During SuperSync end-to-end encryption setup, all user operations are uploaded and stored in plaintext before an encryption password is set. The exposed operations can include private task content and connected issue-provider credentials such as reusable passwords, API tokens and app passwords. Data stays stored if a user leaves the password step, and disabling SuperSync does not remove plaintext already uploaded.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. From 17.3.0 until 18.13.1, the SuperSync end-to-end encryption setup calls sync(true) before a user sets an encryption password, causing the operation-upload path to transmit and store all user operations in plaintext. The exposed operations can include private task content and connected issue-provider credentials, including reusable passwords, API tokens, and app passwords. Users who complete E2EE setup have the plaintext operations deleted, while users who leave the password-setting step can leave the data stored indefinitely. The Disable SuperSync action did not remove plaintext that had already been uploaded. Routing and causal metadata remain plaintext by design and are not part of this vulnerability. This issue is fixed in version 18.13.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| super-productivity | super-productivity | 17.3.0 to before 18.13.1 | 18.13.1 | Patch available | CNA |
- super-productivity Vendorsuper-productivity Affected 17.3.0 to before 18.13.1 Fixed in 18.13.1 Patch available CNA
Remediation
Upgrade Super Productivity to version 18.13.1, which fixes this issue.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA super-productivity (super-productivity) Fixed in 18.13.1
Timeline
- 2026-10-12 Threatist record created from CVE-2026-102539
- 2026-10-13 Priority changed: MEDIUM → LOW
- 2026-10-16 CISA SSVC decision points changed
- 2026-10-16 Priority changed: LOW → MEDIUM
References
Other 4
- https://github.com/super-productivity/super-productivity/security/advisories/GHSA-9v8x-68pf-p5x7
- https://github.com/super-productivity/super-productivity/pull/8670
- https://github.com/super-productivity/super-productivity/commit/63253f8e0c3b145f2d47f819ab8f910d6873fd88
- https://github.com/super-productivity/super-productivity/releases/tag/v18.13.1
More super-productivity vulnerabilities
- TI-2026-50124 Super Productivity: Arbitrary OS Command Execution via IPC EXEC Handler with Persistent Whitelist CVSS 3.1HIGH 7.8
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences