CVE-2026-73230
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
Ente prior to 2026.07.28 stored the secret byte length and 32-bit FNV-1a checksum in cleartext on every card in the 2of3 card format version 1, allowing someone with one card to test candidate secrets offline and recover low-entropy or predictable secrets.
Risk Assessment
The risk includes the possibility of secret recovery by an attacker with access to one card, potentially compromising confidentiality of data protected by Ente.
Recommendation
Upgrade Ente to version 2026.07.28 or later, which includes a fix.
Original NVD description (English source)
Ente provides end-to-end encrypted cloud services and security tools. Prior to 2026.07.28, Ente 2of3 card format version 1 stored the secret byte length and 32-bit FNV-1a checksum in cleartext on every card, allowing someone with one card to test candidate secrets offline and recover low-entropy or predictable secrets. This issue is fixed in version 2026.07.28.