CVE-2026-107021 Details
Description
Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows unauthorized attackers to arbitrarily read flashcards across the user's entire memorization database.
A vulnerability exists in the CardProvider content provider of AnyMemo version 10.12.2, allowing unauthorized applications to read flashcard data from the user's entire memorization database. This issue arises from improper export permissions in the content provider, which is accessible to any app without restriction.
As of now, no fix has been released for this vulnerability. However, it is recommended to add a permission requirement to the affected content provider or to set it as not exported, so that only the vendor's own applications can access it.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 29, 2026CISA-ADP
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107021.md | CISA-ADP | AdvisoryExploitRemedy |
| https://f-droid.org/packages/org.liberty.android.fantastischmemo/ | [email protected] | ProductVendor |
| https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107021.md | [email protected] | AdvisoryExploitRemedy |
| https://github.com/helloworld1/AnyMemo | [email protected] | ProductVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-926 | Improper Export of Android Application Components | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| helloworld1 AnyMemo | 20260730 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | CVE Modified | CISA-ADP |
| Oct 29, 2026 | New CVE Received | [email protected] |