CVE-2026-107055 Details
Description
Insecure permissions in the autosave component of AppML neutriNote CE versionCode 1387 allows unauthorized attackers to write arbitrary files.
A vulnerability exists in the autosave feature of AppML neutriNote CE version 1387. It allows unauthorized attackers to write arbitrary files due to insecure permissions. The issue arises because the app's autosave component, which is exported and lacks proper permission controls, can be manipulated by external applications to overwrite or append data to files within the user's note repository.
As of now, no fix has been released for this vulnerability. However, it is recommended to add a permission requirement to the 'DisplayDBEntry' activity or to set 'android:exported' to false, restricting access to only the app's own components.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 29, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107055.md | CISA-ADP | AdvisoryExploitRemedy |
| https://f-droid.org/packages/com.appmindlab.nano/ | [email protected] | Product |
| https://github.com/appml/neutrinote | [email protected] | ProductSource CodeVendor |
| https://github.com/appml/neutrinote/issues/71 | [email protected] | Issue TrackingVendor |
| https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107055.md | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-732 | Incorrect Permission Assignment for Critical Resource | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| AppML neutriNote CE | 1387 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | CVE Modified | CISA-ADP |
| Oct 29, 2026 | New CVE Received | [email protected] |