Wire Webapp Local Database Deletion Failure on Logout Vulnerability

A regression in the Wire Webapp has led to a failure in the local database deletion process during user logout. This issue affects both temporary clients, which mark the device as public, and regular clients that request the deletion of personal information and conversations upon logout. The vulnerability requires access to the machine to retrieve the data. If encryption-at-rest is enabled, cryptographic material cannot be exported.

Impact

The vulnerability prevents the proper deletion of local data upon logout, leading to residual data remaining on the device. This issue could be exploited to access personal information and conversations that were intended to be deleted.

Remediation

Users can manually delete the database on devices that were marked as public computers prior to login or after a logout request to delete local data was made. The issue has been fixed in Wire Webapp version 2025-05-14-production.0.