CVE-2026-107023 Details
Description
Insecure permissions in the ContentProvider component of mhss1 MyBrain v3.1.0 allows unauthorized attackers to arbitrarily read another user's private notes/tasks/diary content.
A vulnerability in the ContentProvider component of MyBrain version 3.1.0 for Android has been identified, allowing unauthorized access to another user's private notes, tasks, and diary entries. This issue arises from exported activities that lack proper permissions, enabling attackers to silently insert chosen content into the user's personal database without any confirmation or oversight.
As of October 2026, no fix has been released. It is recommended to add a permission requirement or to set 'android:exported' to 'false' for the affected activities, so that only the vendor's own applications can access them.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 29, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107023.md | CISA-ADP | AdvisoryExploitRemedy |
| https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107023.md | [email protected] | AdvisoryExploitRemedy |
| https://github.com/mhss1/MyBrain | [email protected] | ProductVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-732 | Incorrect Permission Assignment for Critical Resource | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| mhss1 MyBrain | 3.1.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | CVE Modified | CISA-ADP |
| Oct 29, 2026 | New CVE Received | [email protected] |