CVE-2026-102539 super-productivity CVE debrief

Who should care

Defenders responsible for Super Productivity deployments, particularly those using SuperSync E2EE setup, should assess exposure and verify encryption password setup. This includes reviewing Super Productivity configurations, verifying user completion of E2EE setup, and ensuring that an encryption password is set. Additionally, defenders should prioritize verifying exposure for users of Super Productivity versions between 17.3.0 and 18.13.1, assessing Super

Why it matters

Defenders should prioritize verifying exposure for users of Super Productivity versions between 17.3.0 and 18.13.1, assessing whether SuperSync E2EE setup was used, and ensuring an encryption password is set.

• Verify encryption password setup for SuperSync E2EE
• Assess exposure of user operations in plaintext
• Update Super Productivity to version 18.13.1 or later
• Monitor for suspicious activity related to Super Productivity operations

Technical summary

Super Productivity's SuperSync E2EE setup transmitted and stored user operations in plaintext before a user sets an encryption password. The issue is fixed in version 18.13.1. The vulnerability affects users of Super Productivity versions between 17.3.0 and 18.13.1 who used SuperSync E2EE setup. The exposed operations can include private task content and connected issue-provider credentials, including reusable passwords, API tokens, and app passwords. The Disable SuperSync action did not remove plaintext that had already been uploaded.

Defensive priority

Defenders should prioritize verifying exposure for users of Super Productivity versions between 17.3.0 and 18.13.1, assessing whether SuperSync E2EE setup was used, and ensuring an encryption password is set.

Recommended defensive actions

• Verify Super Productivity version and assess exposure to SuperSync E2EE setup vulnerability
• Ensure encryption password is set for SuperSync E2EE
• Review and update Super Productivity to version 18.13.1 or later
• Monitor for suspicious activity related to Super Productivity operations
• Perform a thorough review of Super Productivity configurations to identify potential exposure
• Verify that all Super Productivity users have completed E2EE setup and have set an encryption password
• Check for any suspicious activity related to Super Productivity operations in logs

Evidence notes

The CVE record and source item detail indicate that Super Productivity's SuperSync E2EE setup transmitted and stored user operations in plaintext before a user sets an encryption password. This issue is fixed in version 18.13.1.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.