End-to-End Encryption Flaw in Super Productivity Todo App by Super Productivity

CVE-2026-102539

What is CVE-2026-102539?

The Super Productivity app, designed for advanced task management, has a significant vulnerability wherein the SuperSync feature improperly initiates the syncing process before a user establishes an encryption password. This flaw leads to sensitive user operations, including task content and connected service credentials, being transmitted and stored in plaintext. Users who complete the end-to-end encryption setup will see this plaintext data deleted; however, if they do not finish the password-setting process, this data can remain accessible indefinitely. Importantly, the Disable SuperSync function does not remove any previously uploaded plaintext data, leaving it at risk. This issue has been addressed in version 18.13.1.

References