Critical · 9.1 CVE-2026-107045 EUVD-2026-113268GHSA-gr6h-grcp-3fqc

Insecure permissions in the CitrineContentProvider component of Citrine v3.1.0 (versionCode 62) allows unauthorized attackers to arbitraril…

Published Oct 29, 2026 · Updated Nov 4, 2026 · Assigned by mitre

Description

Insecure permissions in the CitrineContentProvider component of Citrine v3.1.0 (versionCode 62) allows unauthorized attackers to arbitrarily read another's Nostr event database.

References

https://f-droid.org/packages/com.greenart7c3.citrine/
https://github.com/greenart7c3/Citrine
https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107045.md