CVE-2025-48066: Wire Wire-webapp Data Deletion Vulnerability

CVE-2025-48066 Overview

CVE-2025-48066 affects wire-webapp, the browser-based client for the Wire secure messaging platform. A regression introduced by a prior bug fix broke the routine that deletes the local IndexedDB database on user logout. Clients marked as "public computer" and clients explicitly requesting deletion of local data on logout retain personal information and conversation history after the user believes it has been purged. Exploitation requires local access to the machine where the affected client was used. The issue is tracked under [CWE-226] and [CWE-212] and is fixed in wire-webapp version 2025-05-14-production.0.

Critical Impact
Local conversation data and personal information persist on shared or logged-out devices, defeating the privacy guarantee of the "This is a public computer" and "delete local data" options.

Affected Products

wire-webapp version 2025-04-14-production.0
wire-webapp version 2025-04-29-production.0
wire-webapp version 2025-05-06-alphaging.0

Discovery Timeline

2025-05-22 - CVE-2025-48066 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-48066

Vulnerability Analysis

Wire-webapp stores conversation state, message history, and cryptographic material in a browser-local database. The client offers two mechanisms to remove this data: selecting "This is a public computer" at login, and requesting deletion of all personal information and conversations on logout. Both mechanisms invoke a database deletion routine tied to the @wireapp/core dependency.

A regression introduced by an earlier bug fix caused the deletion routine to silently fail. Logout proceeds and the user interface reports success, but the local database remains intact on disk. A subsequent user of the same browser profile can inspect the persisted store using standard developer tools and recover conversation content. The flaw maps to observable behavioral discrepancy ([CWE-226]) and improper removal of sensitive information before storage or transfer ([CWE-212]).

Where encryption-at-rest is enabled at the operating system or browser level, cryptographic material cannot be exported, which limits the scope of recovery to what the current browser session can decrypt.

Root Cause

The underlying defect resides in the @wireapp/core package consumed by wire-webapp. The patched release bumps the dependency from @wireapp/core@46.23.6 to @wireapp/core@46.23.7, which restores the database deletion code path on logout.

Attack Vector

Exploitation is local and requires physical or interactive access to the device where an affected wire-webapp client was used. An attacker who obtains the browser profile after the victim logs out can read the persisted IndexedDB store and recover conversation data that the victim expected to be wiped.

text

// Patch excerpt from yarn.lock — dependency bump restoring database deletion
-"@wireapp/core@npm:46.23.6":
-  version: 46.23.6
-  resolution: "@wireapp/core@npm:46.23.6"
+"@wireapp/core@npm:46.23.7":
+  version: 46.23.7
+  resolution: "@wireapp/core@npm:46.23.7"
   dependencies:
     "@wireapp/api-client": "npm:^27.51.0"
     "@wireapp/commons": "npm:^5.4.2"

Source: wireapp/wire-webapp commit 4c0ed5f

Detection Methods for CVE-2025-48066

Indicators of Compromise

Presence of Wire IndexedDB stores in a browser profile after a user has logged out with the "delete local data" option selected.
wire-webapp build identifiers earlier than 2025-05-14-production.0 reported by the client footer or about dialog.
@wireapp/core dependency pinned to 46.23.6 or earlier in self-hosted deployments.

Detection Strategies

Enumerate browser profiles on shared or kiosk endpoints and search for residual Wire storage keys under IndexedDB after logout events.
Inventory self-hosted wire-webapp deployments and match the deployed version string against the fixed release 2025-05-14-production.0.
Audit endpoint software inventories for Wire desktop wrappers that embed vulnerable wire-webapp builds.

Monitoring Recommendations

Track logout and account-switch events on shared devices and correlate them with subsequent file activity in the browser profile directory.
Alert on deployments still serving wire-webapp builds dated between 2025-04-14 and 2025-05-13.
Review web application deployment pipelines for pinned versions of @wireapp/core at or below 46.23.6.

How to Mitigate CVE-2025-48066

Immediate Actions Required

Upgrade wire-webapp to version 2025-05-14-production.0 or later across all self-hosted and managed deployments.
On any device where "This is a public computer" was used or a logout with data deletion was requested on a vulnerable build, manually delete the browser IndexedDB store for the Wire origin.
Instruct users on shared endpoints to clear browser site data for the Wire domain until confirmation that the fixed version is deployed.

Patch Information

The fix is delivered by upgrading the internal @wireapp/core dependency from 46.23.6 to 46.23.7, shipped in wire-webapp release 2025-05-14-production.0. Details are documented in the GitHub Security Advisory GHSA-qc6c-2hh8-qfh8 and the remediation commit 4c0ed5f.

Workarounds

Manually delete the Wire IndexedDB database from the browser profile after logout on affected versions.
Enable full-disk or profile-level encryption-at-rest so that cryptographic material cannot be extracted from residual storage.
Avoid using the "This is a public computer" option on any endpoint running an unpatched wire-webapp build.

bash

# Manually remove residual Wire IndexedDB data on Linux Chromium profiles
rm -rf "$HOME/.config/google-chrome/Default/IndexedDB/https_app.wire.com_0.indexeddb.leveldb"
rm -rf "$HOME/.config/google-chrome/Default/Local Storage/leveldb"