Critical · 9.1 CVE-2026-107038 EUVD-2026-113168GHSA-pvrj-5wq6-mp8q

Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an exported component, leadin…

Published Oct 29, 2026 · Updated Nov 3, 2026 · Assigned by mitre

Description

Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of application data.

References

https://f-droid.org/packages/de.yaacc/
https://github.com/cbejr/yaacc
https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107038.md