{"id":"CVE-2026-107045","aliases":[],"cve":{"records":[{"id":"CVE-2026-107045","source":"mitre","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-07T00:00:00.000Z","published":"2026-10-29T00:00:00.000Z","modified":"2026-11-04T00:56:31.671Z"}],"publishers":[{"name":"mitre","role":"CNA","organizationId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","modified":"2026-10-29T16:15:46.591Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-04T00:56:31.671Z"}],"references":[{"url":"https://f-droid.org/packages/com.greenart7c3.citrine/","tags":[],"source":"mitre"},{"url":"https://github.com/greenart7c3/Citrine","tags":[],"source":"mitre"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107045.md","tags":[],"source":"mitre"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107045.md","tags":["exploit"],"source":"CISA-ADP"}],"weaknesses":[{"id":"CWE-732","description":"CWE-732 Incorrect Permission Assignment for Critical Resource","source":"CISA-ADP"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-04T00:55:38.760832Z","decisions":[{"name":"Exploitation","value":"poc"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"total"}]}]},"title":"Insecure permissions in the CitrineContentProvider component of Citrine v3.1.0 (versionCode 62) allows unauthorized attackers to arbitrarily read another's…","titleSource":"mitre","descriptionSource":"mitre","description":"Insecure permissions in the CitrineContentProvider component of Citrine v3.1.0 (versionCode 62) allows unauthorized attackers to arbitrarily read another's Nostr event database.","score":9.1,"severity":"critical","published":"2026-10-29T00:00:00.000Z","modified":"2026-11-04T00:56:31.671Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"n/a","name":"n/a","platforms":[],"versions":[{"version":"n/a","status":"affected"}],"cpes":[],"source":"mitre","url":"https://www.cve.org/CVERecord?id=CVE-2026-107045"}],"remediation":[],"references":["https://f-droid.org/packages/com.greenart7c3.citrine/","https://github.com/greenart7c3/Citrine","https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107045.md"],"sources":[{"name":"CVE","id":"CVE-2026-107045","modified":"2026-11-04T00:56:31.671Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-107045"}],"assessments":[{"source":"CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","score":9.1}],"sourceAffected":[],"observedAt":"2026-11-04T01:16:54.682Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T22:15:32.260Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T11:25:36.756Z","attemptedAt":"2026-10-30T11:25:36.756Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-30T11:25:37.511Z","attemptedAt":"2026-10-30T11:25:37.511Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-30T11:25:37.436Z","attemptedAt":"2026-10-30T11:25:37.436Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T11:25:36.592Z","attemptedAt":"2026-10-30T11:25:36.592Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-107045","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107045","modified":"2026-10-29T17:17:56.933","checkedAt":"2026-10-30T11:25:36.756Z"},{"source":"ENISA EUVD","id":"EUVD-2026-113268","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113268","modified":"Oct 29, 2026, 4:15:46 PM","checkedAt":"2026-10-30T11:25:37.436Z"},{"source":"GitHub Advisory Database","id":"GHSA-gr6h-grcp-3fqc","url":"https://github.com/advisories/GHSA-gr6h-grcp-3fqc","modified":"2026-10-29T18:31:09Z","checkedAt":"2026-10-30T11:25:37.511Z"}],"aiSummary":{"text":"Citrine v3.1.0 has insecure permissions in its CitrineContentProvider component, potentially allowing unauthorized attackers to read another's Nostr event database. The weakness is due to incorrect permission assignment. The impact and required attacker access are unclear.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-04T01:21:01.590Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-107045"}]}}