CVE-2026-107016 Details
Description
Insecure permissions in Fossify v1.3.0 allows unauthorized attackers to access and read another user's stored contacts.
A vulnerability in Fossify Contacts version 1.3.0 and Simple Contacts Pro version 107 allows unauthorized access to private contacts stored by users. This issue arises from an exported content provider, 'MyContactsContentProvider', which is declared with 'android:exported="true"' and without any permission requirements. As a result, any application can query the content provider to access private contact information, including phone numbers and other personal details.
As of October 2026, no fix has been released for this vulnerability. However, it is recommended to add a permission requirement to the content provider or to set 'android:exported="false"' to prevent unauthorized access.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 29, 2026CISA-ADP
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Fossify Contacts | 1.3.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | CVE Modified | CISA-ADP |
| Oct 29, 2026 | New CVE Received | [email protected] |