Insecure Storage of Sensitive Information in Content Sync (content-sync.io) - CVE-2026-118568
Published: October 30, 2026
Vulnerability identifier: #VU158567
CSH Severity: Low
CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-118568
CWE-ID: CWE-922
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to gain access to potentially sensitive information.
The vulnerability exists due to the affected module does not sufficiently encrypt the password of the system user used when synchronizing content. A remote administrator can gain unauthorized access to sensitive information on the system.
Affected software
Content Sync (content-sync.io)
How to mitigate CVE-2026-118568
Install updates from vendor's website.
Content Sync (content-sync.io) - update to 3.2.2