CVE-2026-107043 Details
Description
Insecure permissions in Code Catcher versionCode 131 allow unauthorized attackers to arbitrarily manipulate the app's SMS-code-capture mechanism.
A vulnerability exists in Code Catcher version 131 due to insecure permissions that allow unauthorized attackers to manipulate the application's SMS code capture feature. The issue arises from an exported activity that, when triggered, enables a debug component that is normally disabled, allowing access to internal logs related to SMS and OTP capture.
As of September 27, 2026, no fix has been released. It is recommended to add a permission to the affected component or to set 'android:exported' to 'false' where external access is not intended.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 29, 2026CISA-ADP
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107043.md | CISA-ADP | AdvisoryExploitRemedy |
| https://f-droid.org/packages/co.ec.cnsyn.codecatcher/ | [email protected] | ProductVendor |
| https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107043.md | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-926 | Improper Export of Android Application Components | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| CodeCatcher | 131 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | CVE Modified | CISA-ADP |
| Oct 29, 2026 | New CVE Received | [email protected] |