{"id":"CVE-2026-73230","summary":"Ente: 2of3 cards v1 contain a checksum that enables offline guessing of low-entropy secrets","details":"Ente provides end-to-end encrypted cloud services and security tools. Prior to 2026.07.28, Ente 2of3 card format version 1 stored the secret byte length and 32-bit FNV-1a checksum in cleartext on every card, allowing someone with one card to test candidate secrets offline and recover low-entropy or predictable secrets. This issue is fixed in version 2026.07.28.","aliases":["GHSA-v6x7-rrch-9q9w"],"modified":"2026-08-15T11:31:16.766687114Z","published":"2026-08-11T19:17:03.159Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"fixed":"2026.07.28"}],"source":"AFFECTED_FIELD"}],"cna_assigner":"GitHub_M","cwe_ids":["CWE-200"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73230.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73230.json"},{"type":"ADVISORY","url":"https://github.com/ente/ente/security/advisories/GHSA-v6x7-rrch-9q9w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73230"},{"type":"FIX","url":"https://github.com/ente/ente/commit/6681d8370a37c2fc745d3098126ba1ee62bf06a5"},{"type":"FIX","url":"https://github.com/ente/ente/commit/c3d2e400ae6fa66d5ce7df422136d28805fe1442"},{"type":"FIX","url":"https://github.com/ente/ente/pull/11729"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/ente/ente","events":[{"introduced":"0"},{"fixed":"6681d8370a37c2fc745d3098126ba1ee62bf06a5"},{"fixed":"c3d2e400ae6fa66d5ce7df422136d28805fe1442"}],"database_specific":{"source":"REFERENCES"}}],"versions":["photos-desktop-v1.7.27-beta","photos-v1.3.59-beta","locker-v1.0.7-beta","cli-v0.3.0","photos-v1.3.58-beta","photos-desktop-v1.7.26-beta","auth-v4.4.24-rc","auth-v4.4.24","auth-v4.4.24-beta","photos-v1.3.57-beta","photos-desktop-v1.7.25-beta","photos-v1.3.57-rc","photos-v1.3.57","locker-v1.0.6-rc","locker-v1.0.6","locker-v1.0.6-beta","photos-v1.3.56","photos-v1.3.56-beta","photosd-v1.7.24","photos-v1.3.44","photosd-v1.7.23","locker-v1.0.3","locker-v1.0.2","ensu-v0.1.15","photosd-v1.7.22","ensu-v0.1.14","ensu-v0.1.12","ensu-v0.1.11","ensu-v0.1.10","server/ghcr","locker-v1.0.1","photosd-v1.7.21","photosd-v1.7.20","photosd-v1.7.19","ensu-v0.1.8","ensu-v0.1.7","ensu-v0.1.6","ensu-v0.1.5","ensu-v0.1.4","ensu-v0.1.3","locker-v1.0.0","auth-v4.4.16","locker-v0.1.4","photosd-v1.7.17","photos-v1.2.20","photosd-v1.7.16","photosd-v1.7.15","photos-v1.2.10","photos-v1.2.8","photos-v1.2.4","auth-v4.4.3","auth-v4.4.2","photosd-v1.7.14","photosd-v1.7.13","auth-v4.3.8","photos-v1.0.10","auth-v4.3.6","photosd-v1.7.12","photos-v1.0.2","photosd-v1.7.11","photos-v1.0.0","auth-v4.3.3","photosd-v1.7.10","cli-v0.2.3","photos-v0.9.95","photosd-v1.7.9","auth-v4.3.2","auth-v4.3.1","auth-v4.3.0","auth-v4.2.9","photos-v0.9.79","photos-v0.9.81","auth-v4.2.8","auth-v4.2.7","auth-v4.2.6","photosd-v1.7.8","auth-v4.2.4","photos-v0.9.76","photos-v0.9.75","auth-v4.2.3","auth-v4.2.2","auth-v4.2.1","auth-v4.2.0","photos-v0.9.72","photos-v0.9.71","auth-v4.1.6","photos-v0.9.66","auth-v4.1.4","auth-v4.1.2","photosd-v1.7.7","photos-v0.9.65","auth-v4.1.1","photos-v0.9.53","auth-v4.1.0","photosd-v1.7.6","cli-v0.2.2","photos-v0.9.52","photos-v0.9.49","photos-v0.9.48","photos-v0.9.47","photos-v0.9.46","photosd-v1.7.5","auth-v4.0.2","auth-v4.0.1","photos-v0.9.44","cli-v0.2.1","cli-v0.2.0","photos-v0.9.42","photos-v0.9.41","auth-v4.0.0","auth-v3.1.8","photos-v0.9.35","photosd-v1.7.4","photos-v0.9.30","photos-v0.9.27","auth-v3.1.3","photosd-v1.7.3","cli-v0.1.18","auth-v3.1.1","auth-v3.1.0","photos-v0.9.16","photos-v0.9.14","photosd-v1.7.2","photos-v0.9.7","photos-v0.9.5","auth-v3.0.13","cli-v0.1.17","auth-v3.0.17","photos-v0.9.2","cli-v0.1.16","photosd-v1.7.1","photos-v0.9.0","auth-v3.0.12","auth-v3.0.11","cli-v0.1.15","auth-v3.0.8","photos-v0.8.131","auth-v3.0.7","auth-v3.0.6","photos-v0.8.128","photos-v0.8.127","cli-v0.1.14","photosd-v1.7.0","auth-v3.0.4","auth-v3.0.3","auth-v3.0.2","auth-v3.0.1","auth-v3.0.0","auth-v2.0.58","photos-v0.8.94","photos-v0.8.81","photos-v0.8.79","auth-v2.0.55","auth-v2.0.54","auth-v2.0.53","auth-v2.0.52","auth-v2.0.51","photos-v0.8.75","photos-v0.8.74","auth-v2.0.50","cli-v0.1.13","auth-v2.0.48","auth-v2.0.47","auth-v2.0.46","photos-v0.8.70","cli-v0.1.12","photos-v0.8.68","auth-v2.0.41","auth-v2.0.40","auth-v2.0.36","cli-v0.1.11","nightly","v2.0.34","v2.0.30","v2.0.28","v2.0.26","v2.0.25","v2.0.24","v2.0.22","v2.0.19","v2.0.18","v2.0.15","v2.0.14","v2.0.13","v2.0.12","v2.0.11","v2.0.10","v2.0.7","v2.0.5","v2.0.1","v2.0.0","v1.0.56","v1.0.55","v1.0.54","v1.0.52","v1.0.51","v1.0.50","v1.0.41","v1.0.40","v1.0.39","v1.0.37","v1.0.34","v1.0.32","v1.0.31","v1.0.28","v1.0.25","v1.0.18","v1.0.17","v1.0.16","v1.0.15","v1.0.14","v1.0.12","v1.0.11","v1.0.10","v1.0.8","v1.0.7","v1.0.6","v1.0.5","v1.0.3","v1.0.2","v1.0.1","v1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73230.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}