Super Productivity’s SuperSync end‑to‑end encryption setup triggers a sync before the user establishes an encryption password, resulting in the transmission and storage of all user operations in plaintext. These operations can include private task content and credentials such as passwords, API tokens, and app passwords. When a password is set, the application deletes the plaintext uploads; however, if the user stops before setting a password, the data remains stored permanently.

Versions of Super Productivity from 17.3.0 through 18.13.1 are affected when the SuperSync setup is initiated. The issue originates from the super‑productivity application and does not impact other vendors or products.

The CVSS score of 5.7 indicates moderate severity. An EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation. Based on the description, the likely attack vector is local access to the device or observation of the sync operation before a password is assigned. With persistent storage of the plaintext data, an attacker who obtains device access could recover sensitive information that remains until the user manually removes it or updates the application.