CVE-2026-107045

CriticalCVSS 9.1/10Last modified Nov 4, 2026

Description

Insecure permissions in the CitrineContentProvider component of Citrine v3.1.0 (versionCode 62) allows unauthorized attackers to arbitrarily read another's Nostr event database.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-732

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

Timeline

Published: Oct 29, 2026
Last modified: Nov 4, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1070465.3A Server-Side Request Forgery (SSRF) in the url/title/author/coverUrl component of FocusPodcast versionCode 70allows attackers to scan inter CVE-2026-1070477.5Insecure permissions in mendhak GPSLogger versionCode 137 allows unauthorized attackers to arbitrarily manipulate the app's logging mechanis CVE-2026-1070489.8An issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101 allows attackers to execute arbitrary code via CVE-2026-1070497.5An issue in Forkyz versionCode 8500000 allows attackers to arbitrarily change another user's storage settings via supplying a crafted URI st CVE-2026-107053.1A flaw has been found in dask up to 3.0. Affected by this issue is the function nunique_approx of the file dask/dataframe/hyperloglog.py of CVE-2026-1070509.8An issue in libretro RetroArch v1.22.2 allows attackers to force another user into loading attacker-supplied code in their uid, leading to a CVE-2026-1070517.5Insecure permissions in klassm AndFHEM v2.4.1 (versionCode 241, the verified build) allows unauthorized attackers to arbitrarily manipulate CVE-2026-1070527.5Insecure permissions in the AIDL interface of ProjectMAXS MAXS Module FileRead versionCode 27 allows unauthorized attackers to arbitrarily r CVE-2026-1070539.1Insecure permissions in foobnix Librera PDF Reader versionCode 7222 allows unauthorized attackers to arbitrarily write and truncate files in CVE-2026-1070557.5Insecure permissions in the autosave component of AppML neutriNote CE versionCode 1387 allows unauthorized attackers to write arbitrary file CVE-2026-1070569.1Insecure permissions in the io.file.importer.ImportActivity component of OpenTracks versionCode 6751 allows unauthorized attackers to inject CVE-2026-1070579.8An issue in AndBible versionCode 1111 allows attackers to execute arbitrary code via uploading a crafted module zip.