Tracker
Vulnerabilities & CVEs
Named security defects in Dropbox's software — plus documented abuse of its platform — with severity, status, and sources. A serious record tracks the identifier-bearing flaws, not only the headline breaches.
Lenovo ID SSO flaw (no CVE)HighMitigated2026Lenovo ID linked-login flaw let attackers into ~5,000 Dropbox accounts
Between 4 and 21 August 2026, an attacker exploited a flaw in how Lenovo verified account-holder email addresses to register a Lenovo ID on a victim's email; Dropbox's Lenovo ID sign-in link then trusted that Lenovo-asserted identity without ever asking for a Dropbox password, reaching roughly 5,000 accounts (files were accessed in fewer than a third of them). No CVE has been assigned (NVD search returned none as of 2026-09-05). Dropbox expired all Lenovo-linked sessions, severed the Lenovo integration, and now requires a Dropbox password for future Lenovo ID sign-in.
Affected: Account sign-in (Lenovo ID linked login)
CVE-2024-5924MediumPatched2024Mark-of-the-Web bypass in the Dropbox Windows client
Files arriving via Dropbox sync could be written without the Windows 'Mark of the Web' flag, stripping SmartScreen/Protected-View warnings that protect users from running downloaded, untrusted content. Remediated in current client releases.
Affected: Dropbox desktop (Windows)
CVE-2024-25718MediumPatched2024Heap-buffer-overflow in Dropbox's Lepton image library
A heap-buffer-overflow in Lepton — Dropbox's open-source JPEG-recompression library used in its storage pipeline — could be triggered by a crafted image (in aligned_dealloc(), src/lepton/bitops.cc), leading to denial of service or possible escalation. Fixed in Lepton 1.2.1.
Affected: Lepton (Dropbox open-source image compression, < 1.2.1)
Platform abuse (C2)MediumOngoing2024Dropbox API abused as malware command-and-control
Not a flaw in Dropbox, but a recurring abuse: state-aligned groups (e.g. Kimsuky, ScarCruft) use the trusted Dropbox API as a command-and-control and exfiltration channel that blends into normal enterprise traffic.
Affected: Dropbox API
CVE-2022-4768HighPatched2022Injection / RCE in Dropbox's merou (Grouper) SSH key handler
A critical remote injection flaw in the add_public_key function of merou (Dropbox's open-source 'Grouper' authorization-management tool): the public_key_str argument was insufficiently validated, enabling code injection. Remotely exploitable; patched upstream.
Affected: merou / Grouper (Dropbox open-source authorization tool)
2019 client zero-dayHighMitigated2019Local privilege-escalation zero-day in the Dropbox Windows client
An arbitrary-file-overwrite flaw in the DropboxUpdater service on Windows let a local, low-privileged user replace executables that the service then ran as SYSTEM. Researchers Chris Danieli and 'Decoder' reported it to Dropbox on 18 September 2019 and published after their 90-day window passed without a fix; 0patch issued a temporary micropatch in December 2019. Attackers need local access first, so the flaw matters as a privilege-escalation link in a chain rather than a remote entry point. Dropbox's own fix is not confirmed in the sources reviewed.
Affected: Dropbox desktop (Windows)
CVE-2014-8889MediumPatched2015"DroppedIn" — OAuth token interception in the Dropbox SDK for Android
NVD: "Dropbox SDK for Android before 1.6.2 might allow remote attackers to obtain sensitive information via crafted malware or via a drive-by download attack." Rated CVSS v2 2.6 (LOW) at the time but CVSS v3.0 5.3 (MEDIUM) under NVD's current scoring; CWE-200 (information exposure). IBM X-Force researchers found the flaw — dubbed "DroppedIn" — in SDK versions 1.5.4 through 1.6.1, letting attackers intercept OAuth tokens during authentication without user interaction beyond app install; Dropbox released patched SDK 1.6.2 to fix it.
Affected: Dropbox SDK for Android (third-party apps)
Keeping the Dropbox desktop and mobile apps updated remediates the client-side issues above. See the breach tracker for full incident reports.