CVE-2026-107015 Details
Description
Insecure permissions in Simple Contacts Pro versionCode 107 allow unauthorized attackers to write and read notes in another user's' note database.
A vulnerability exists in Simple Contacts Pro and Fossify Contacts, specifically in version 107, due to insecure permissions that allow unauthorized access to another user's notes in the note database. The issue arises from an exported, permission-less content provider that exposes private contact information to any application on the device.
As of now, no fix has been released for this vulnerability. However, it is recommended to add a permission requirement to the content provider or to disable the export of the provider entirely, preventing access from external applications.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 29, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107015-CVE-2026-107016.md | CISA-ADP | AdvisoryBundleExploitRemedy |
| https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107015-CVE-2026-107016.md | [email protected] | AdvisoryBundleExploitRemedy |
| https://github.com/kanytu/Simple-Contacts/issues/628 | [email protected] | Broken LinkIssue TrackingVendor |
| https://github.com/SimpleMobileTools/Simple-Contacts | [email protected] | ProductVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Simple Contacts Pro | 107 108 1.3.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 29, 2026 | New CVE Received | [email protected] |