Critical · 9.1 CVE-2026-107021 EUVD-2026-113181GHSA-hjxf-6wgx-5x27

Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows unauthorized attacke…

Published Oct 29, 2026 · Updated Nov 3, 2026 · Assigned by mitre

Description

Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows unauthorized attackers to arbitrarily read flashcards across the user's entire memorization database.

References

https://f-droid.org/packages/org.liberty.android.fantastischmemo/
https://github.com/helloworld1/AnyMemo
https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107021.md