CVE-2026-73230: Ente Information Disclosure Vulnerability

CVE-2026-73230 Overview

Ente provides end-to-end encrypted cloud services and security tools, including a 2of3 card feature that splits a secret into three physical shares using Shamir secret sharing. Prior to version 2026.07.28, the version 1 card format stored the secret byte length and a 32-bit FNV-1a checksum in cleartext on every card. An attacker who obtains a single card can use this cleartext metadata to test candidate secrets offline and recover low-entropy or predictable secrets without ever collecting a second share. The issue is tracked as an information exposure weakness [CWE-200] and is fixed in version 2026.07.28.

Critical Impact
A single lost or stolen 2of3 card is sufficient to mount an offline brute-force attack against the underlying secret when that secret has low entropy.

Affected Products

Ente 2of3 card format version 1
Ente web application prior to 2026.07.28
Any Ente-generated 2of3 shares issued before the 2026.07.28 release

Discovery Timeline

2026-08-11 - CVE-2026-73230 published to the National Vulnerability Database (NVD)
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-73230

Vulnerability Analysis

Ente's 2of3 feature splits a user secret across three printable cards. Two cards are required to reconstruct the secret, and the design goal is that a single card reveals nothing about the underlying value. Version 1 of the card format violated that goal by embedding auxiliary metadata in cleartext within the share header.

Specifically, each card stored the secret byte length and a 32-bit Fowler-Noll-Vo (FNV-1a) checksum computed over the original secret. Both fields are properties of the plaintext secret itself, not the share. An attacker holding one card can iterate candidate secrets, compute their length and FNV-1a checksum, and compare against the values printed on the card. Matches identify the secret without any need for the second share, breaking the security assumption of Shamir secret sharing for low-entropy inputs such as short PINs, passphrases, or dictionary words.

Root Cause

The root cause is an information exposure in the on-card header layout. The 14-byte version 1 header included the plaintext length and FNV-1a checksum as unencrypted fields alongside the share bytes. Because FNV-1a is a non-cryptographic hash with no keying, verification of candidate secrets is trivial and fast on commodity hardware.

Attack Vector

Exploitation requires local access to at least one physical card, which aligns with the local attack vector classification. The attacker performs the following steps offline:

Read the cleartext length and FNV-1a checksum from a recovered card.
Enumerate candidate secrets matching the disclosed length.
Compute FNV-1a over each candidate and compare against the card value.
Confirm the recovered secret by reconstructing the share arithmetic.

typescript

// Patch excerpt: web/apps/twoof3/src/features/twoof3/utils/export.ts
// Format version bumped and header shortened to remove disclosed metadata.
   <script>${escapeScriptTagContent(OFFLINE_QR_DECODER_SOURCE)}</script>
   <script>
     const GF_POLY = 0x11b;
-    const VERSION = 1;
-    const HEADER_LENGTH = 14;
+    const VERSION = 2;
+    const HEADER_LENGTH = 10;
+    const LEGACY_HEADER_LENGTH = 14;
+    const CHECKSUM_LENGTH = 4;
+    const SHARE_OVERHEAD = HEADER_LENGTH + CHECKSUM_LENGTH;
     const gfMul = (left, right) => {
       let result = 0;
       let a = left;
// Source: https://github.com/ente/ente/commit/6681d8370a37c2fc745d3098126ba1ee62bf06a5

Detection Methods for CVE-2026-73230

Indicators of Compromise

Presence of 2of3 cards generated before version 2026.07.28 still in circulation or storage.
Reports of a lost, stolen, photographed, or copied 2of3 card by any user.
Card artifacts encoded with format VERSION = 1 and a 14-byte header, identifiable from the cleartext header structure.

Detection Strategies

Inventory all issued 2of3 cards and identify those produced prior to the 2026.07.28 release by inspecting the format version byte.
Verify the deployed Ente web application build against release notes and commit 6681d837 to confirm the format upgrade is present.
Review any user-reported loss or exposure incidents involving physical cards and treat those secrets as candidates for offline recovery.

Monitoring Recommendations

Track deployment version of the Ente web application in change management to ensure the patched release is in use.
Log and audit 2of3 card generation events, including format version, to prevent regressions to the vulnerable version 1 layout.
Monitor user support channels for reports of physical card exposure and trigger secret rotation workflows automatically.

How to Mitigate CVE-2026-73230

Immediate Actions Required

Upgrade Ente to version 2026.07.28 or later so that new cards are issued in the hardened version 2 format.
Reissue 2of3 cards for any secret that has low entropy or where any card may have been exposed, lost, or photographed.
Rotate the underlying secrets protected by any format version 1 cards that cannot be physically recovered and destroyed.

Patch Information

The fix is delivered in Ente 2026.07.28. The relevant changes bump the card format to version 2, shorten the header to 10 bytes, and remove the cleartext length and FNV-1a checksum from the share header. See the GitHub Security Advisory GHSA-v6x7-rrch-9q9w, the remediation pull request, and the hardening commits 6681d837 and c3d2e400.

Workarounds

Ensure protected secrets are high-entropy (for example, randomly generated keys) so offline guessing against the FNV-1a checksum is computationally infeasible.
Store all 2of3 cards in physically separated, access-controlled locations to reduce the chance of a single card being exposed.
Destroy any format version 1 cards after regenerating shares in the hardened version 2 format.

bash

# Verify the installed Ente web build is at or above the fixed version
git -C ente log --oneline 6681d8370a37c2fc745d3098126ba1ee62bf06a5 -1
git -C ente log --oneline c3d2e400ae6fa66d5ce7df422136d28805fe1442 -1

# Confirm the format version has advanced beyond the vulnerable v1 layout
grep -n "const VERSION" web/apps/twoof3/src/features/twoof3/utils/export.ts
# Expected: const VERSION = 2;