---
id: CVE-2026-102539
title: >-
  Super Productivity is an advanced todo list app with integrated timeboxing and
  time tracking capabilities
summary: >-
  Super Productivity is an advanced todo list app with integrated timeboxing and
  time tracking capabilities. From 17.3.0 until 18.13.1, the SuperSync
  end-to-end encryption setup calls sync(true) before a user sets an encryption
  password, c…
severity: none
cwe:
  - CWE-312
  - CWE-693
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T22:17:01.967'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-102539'
references:
  - url: >-
      https://github.com/super-productivity/super-productivity/commit/63253f8e0c3b145f2d47f819ab8f910d6873fd88
    label: security-advisories@github.com
  - url: 'https://github.com/super-productivity/super-productivity/pull/8670'
    label: security-advisories@github.com
  - url: >-
      https://github.com/super-productivity/super-productivity/releases/tag/v18.13.1
    label: security-advisories@github.com
  - url: >-
      https://github.com/super-productivity/super-productivity/security/advisories/GHSA-9v8x-68pf-p5x7
    label: security-advisories@github.com
tags:
  - nvd
ingestedAt: '2026-10-12T23:07:25.632Z'
---

## Overview

Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. From 17.3.0 until 18.13.1, the SuperSync end-to-end encryption setup calls sync(true) before a user sets an encryption password, causing the operation-upload path to transmit and store all user operations in plaintext. The exposed operations can include private task content and connected issue-provider credentials, including reusable passwords, API tokens, and app passwords. Users who complete E2EE setup have the plaintext operations deleted, while users who leave the password-setting step can leave the data stored indefinitely. The Disable SuperSync action did not remove plaintext that had already been uploaded. Routing and causal metadata remain plaintext by design and are not part of this vulnerability. This issue is fixed in version 18.13.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.