{"id":"CVE-2026-107017","aliases":[],"cve":{"records":[{"id":"CVE-2026-107017","source":"mitre","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-07T00:00:00.000Z","published":"2026-10-29T00:00:00.000Z","modified":"2026-10-30T18:38:55.888Z"}],"publishers":[{"name":"mitre","role":"CNA","organizationId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","modified":"2026-10-29T14:43:24.546Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T18:38:55.888Z"}],"references":[{"url":"https://f-droid.org/packages/net.canvoki.vokibot/","tags":[],"source":"mitre"},{"url":"https://github.com/vokimon/vokibot","tags":[],"source":"mitre"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107017.md","tags":[],"source":"mitre"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107017.md","tags":["exploit"],"source":"CISA-ADP"}],"weaknesses":[{"id":"CWE-284","description":"CWE-284 Improper Access Control","source":"CISA-ADP"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-30T18:07:46.206268Z","decisions":[{"name":"Exploitation","value":"poc"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"total"}]}]},"title":"Insecure permissions in the ShortcutDispatchActivity component of canvoki versionCode 14 allows unauthorized attackers to arbitrarily trigger another user's…","titleSource":"mitre","descriptionSource":"mitre","description":"Insecure permissions in the ShortcutDispatchActivity component of canvoki versionCode 14 allows unauthorized attackers to arbitrarily trigger another user's configured automated actions.","score":9.1,"severity":"critical","published":"2026-10-29T00:00:00.000Z","modified":"2026-10-30T18:38:55.888Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"n/a","name":"n/a","platforms":[],"versions":[{"version":"n/a","status":"affected"}],"cpes":[],"source":"mitre","url":"https://www.cve.org/CVERecord?id=CVE-2026-107017"}],"remediation":[],"references":["https://f-droid.org/packages/net.canvoki.vokibot/","https://github.com/vokimon/vokibot","https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107017.md"],"sources":[{"name":"CVE","id":"CVE-2026-107017","modified":"2026-10-30T18:38:55.888Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-107017"}],"assessments":[{"source":"CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","score":9.1}],"sourceAffected":[],"observedAt":"2026-10-30T18:57:17.917Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T14:15:35.655Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-29T15:30:39.148Z","attemptedAt":"2026-10-29T15:30:39.148Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-29T15:30:39.338Z","attemptedAt":"2026-10-29T15:30:39.338Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-29T15:30:40.210Z","attemptedAt":"2026-10-29T15:30:40.210Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-29T15:30:38.035Z","attemptedAt":"2026-10-29T15:30:38.035Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-107017","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107017","modified":"2026-10-29T15:17:15.437","checkedAt":"2026-10-29T15:30:39.148Z"},{"source":"ENISA EUVD","id":"EUVD-2026-112930","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-112930","modified":"Oct 29, 2026, 2:43:24 PM","checkedAt":"2026-10-29T15:30:40.210Z"}],"aiSummary":{"text":"The ShortcutDispatchActivity component in canvoki versionCode 14 has insecure permissions, allowing unauthorized attackers to trigger another user's automated actions. The weakness is due to improper access control. The impact is arbitrary triggering of configured actions.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-31T10:06:13.723Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-107017"}]}}