CVE-2026-107037 Details
Description
Insecure permissions in the NotificationHelper component of NoNonsense Notes versionCode 72600 allows unauthorized attackers to write in another user's notes via supplying a note id.
A vulnerability exists in the NotificationHelper component of NoNonsense Notes version 72600, where insecure permissions allow unauthorized attackers to modify another user's notes by supplying a note ID. This issue arises from exported broadcast receivers that lack proper permission controls, enabling any app to send broadcasts that directly alter the completion status of notes in the user's database.
As of now, no fix has been released for this vulnerability. However, it is recommended to add a permission requirement to the affected component or to set the component as not exported, ensuring that only the vendor's own applications can interact with it.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 29, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107037.md | CISA-ADP | AdvisoryExploitTechnical Analysis |
| https://f-droid.org/packages/com.nononsenseapps.notepad/ | [email protected] | ProductVendor |
| https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107037.md | [email protected] | AdvisoryExploitTechnical Analysis |
| https://github.com/spacecowboy/NotePad | [email protected] | ProductVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| NoNonsense Notes | 72600 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 29, 2026 | New CVE Received | [email protected] |