CVE-2026-107032 Details
Description
Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow.
A vulnerability in Bulk Share: Location Sender version 2.1.0 allows unauthorized access to an exported component, which can be exploited to gain control over data flow and access arbitrary data. The issue arises from improper permissions that let any app invoke the 'ShareActivity' without restrictions. This activity, designed to handle shared links, automatically adds received link data to the user's link queue without any user interaction or confirmation. The injected links are later bulk-shared with other apps, effectively allowing unauthorized pre-staging of shared content.
As of now, no fix has been released for this vulnerability. However, it is recommended to add a permission requirement to the exported component or to set 'android:exported' to 'false' to prevent unauthorized access from other applications.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 29, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107032.md | CISA-ADP | AdvisoryExploitRemedy |
| https://f-droid.org/packages/me.alexghr.bulkshare.android.app2/ | [email protected] | Broken LinkVendor |
| https://github.com/alexghr/bulkshare | [email protected] | ProductVendor |
| https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107032.md | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-926 | Improper Export of Android Application Components | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| me.alexghr.bulkshare.android.app2 | 2.1.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 29, 2026 | New CVE Received | [email protected] |