Dropbox began emailing users around August 31, 2026, disclosing unauthorized access to accounts between August 4 and August 21, 2026. The access traces to a flaw in Dropbox’s Lenovo ID single sign-on (SSO) option, the same email-claim-as-authenticator bug class behind CVE-2026-55075 (Coder) and CVE-2026-14781 (Keycloak).
What to Know?
- Dropbox notified users beginning around August 31, 2026, of unauthorized account access that ran from August 4 to August 21, 2026.
- A gap in Lenovo’s email verification process let an attacker register a Lenovo ID under a victim’s email address without proving they controlled that inbox, according to Dropbox’s notification email.
- Dropbox then matched the unverified email to an existing Dropbox account and signed the attacker in, with no password required.
- Victims did not need to have ever created a Lenovo ID or linked one to Dropbox to be affected, per Dropbox’s own account of the flaw.
- Dropbox’s fix expired every session authenticated through Lenovo IDs, cut the Lenovo-Dropbox links, and now requires the Dropbox password before a Lenovo ID can sign a user in, a defect security researcher Yoni Levy surfaced publicly.
How It Happened?
Dropbox lets users sign in with a Lenovo ID instead of a password, under a federated identity partnership between the two companies. In the notification email, Dropbox said an issue with Lenovo’s email verification process allowed an unauthorized party to register a Lenovo ID using your email address and then use that Lenovo ID to log into the Dropbox account associated with that email address. An attacker only needed a target’s email address, not access to their inbox, to create the rogue Lenovo ID.
The deeper gap sat on Dropbox’s side. Dropbox did not require a user’s existing Dropbox login to verify the new SSO link before trusting it before granting access, the kind of omission that turns an unverified email claim into full account access with no password involved.
Victims reported rogue Lenovo profiles registered under throwaway names such as “John Madden,” unsolicited Lenovo verification codes, and sign-ins geolocated near Dublin, Ireland. Security researcher Yoni Levy ran the password-reset flow on the Lenovo ID that had been registered to his email, reclaimed the rogue account, and deactivated it, then posted the notification email on X.
so dropbox got hacked (never had a Lenovo account, haven't been to UK) pic.twitter.com/UoYRaJFuEC
— yoni | parser.eth (@yonilevy) August 31, 2026
Why This Bug Class Keeps Recurring?
Treating an email address as proof of identity, not a public label, is the mistake behind this incident and behind CVE-2026-55075 and CVE-2026-14781.
A well-designed flow always forces the account’s own credential to confirm any new identity link. Whether Lenovo has independently closed the registration gap that enabled the forged IDs remains unconfirmed, and that gap would still be live for any other service trusting a Lenovo ID.
Dropbox’s email states its logs show no evidence that files were viewed or downloaded during the exposure window. The company’s notice recommends rotating the Dropbox password, rotating the email password, and enabling two-step verification.
What’s Next?
Affected users should treat the exposure window as a prompt to audit connected apps and sessions, not just change a password and move on. Dropbox has already cut the Lenovo link and now requires password re-entry before a new Lenovo ID can bind to an account, the step-up check that was missing.
Anyone who finds an unfamiliar Lenovo ID tied to their email can run Lenovo’s own password reset flow to reclaim and deactivate it, as Levy did. Users holding sensitive files in Dropbox, such as tax documents, should watch for follow-on phishing that impersonates a “confirm your Dropbox recovery” message in the days ahead.
SQ Magazine’s Takeaway
This breach did not require breaking encryption or guessing a password. It required a hardware vendor’s identity system to accept an unverified string and a cloud storage provider to trust that string without asking its own users to re-prove who they were. That combination reads as an accountability gap between two large technology partners, not a sophisticated attack.
Dropbox’s fix, requiring a password check before any new identity provider can attach to an account, helps reduce the risk of this specific failure recurring on its platform, though it does not address whether Lenovo’s registration flow has been independently fixed and verified.
