CVE-2026-107857: CWE-312: Cleartext Storage of Sensitive Information in dongdongbh Mindwtr

Mindwtr, a free offline-first task management application, had a vulnerability (CVE-2026-107857) in its mobile app versions before 1.1.5 where sensitive credentials such as the Cloud sync bearer token and WebDAV password were stored in cleartext within AsyncStorage under the keys @mindwtr_cloud_token and @mindwtr_webdav_password. This cleartext storage violates secure storage best practices (CWE-312) and could allow an attacker with access to the app database or device backups to extract these credentials and access user data. The issue was resolved in version 1.1.5 by presumably encrypting or securing these credentials.

An attacker with access to the mobile application's local database or an exposed device backup can recover the Cloud sync bearer token and WebDAV password. This could lead to unauthorized access to the user's synchronized tasks and attachments, compromising confidentiality. The CVSS score of 4.4 (medium severity) reflects the local attack vector and required privileges.

Upgrade Mindwtr mobile application to version 1.1.5 or later, where this vulnerability is fixed. Users should avoid using vulnerable versions and ensure device backups are securely protected to prevent unauthorized access. No additional vendor advisory states otherwise.