CVE-2026-107033 Details

A vulnerability in the Mirakel task management application for Android, specifically in version 3.0 (version code 60), has been identified. The issue arises from insecure permissions in the MirakelInternalContentProvider component, which is exported without any permission restrictions. This flaw allows unauthorized applications to arbitrarily read and modify another user's task database. The vulnerable content provider exposes sensitive task information, including task names, due dates, and synchronization states, to any app on the device.

As of the latest update, no fix has been released for this vulnerability. However, it is recommended to add permission requirements to the affected content provider or to set it as not exported, so that only the vendor's own applications can access it.