{"id":"CVE-2026-107047","aliases":[],"cve":{"records":[{"id":"CVE-2026-107047","source":"mitre","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-07T00:00:00.000Z","published":"2026-10-29T00:00:00.000Z","modified":"2026-10-29T20:00:19.322Z"}],"publishers":[{"name":"mitre","role":"CNA","organizationId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","modified":"2026-10-29T16:17:29.020Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-29T20:00:19.322Z"}],"references":[{"url":"https://f-droid.org/packages/com.mendhak.gpslogger/","tags":[],"source":"mitre"},{"url":"https://github.com/mendhak/gpslogger","tags":[],"source":"mitre"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107047.md","tags":[],"source":"mitre"},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107047.md","tags":["exploit"],"source":"CISA-ADP"}],"weaknesses":[{"id":"CWE-732","description":"CWE-732 Incorrect Permission Assignment for Critical Resource","source":"CISA-ADP"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-29T19:59:15.294528Z","decisions":[{"name":"Exploitation","value":"poc"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Insecure permissions in mendhak GPSLogger versionCode 137 allows unauthorized attackers to arbitrarily manipulate the app's logging mechanism and log data.","titleSource":"mitre","descriptionSource":"mitre","description":"Insecure permissions in mendhak GPSLogger versionCode 137 allows unauthorized attackers to arbitrarily manipulate the app's logging mechanism and log data.","score":7.5,"severity":"high","published":"2026-10-29T00:00:00.000Z","modified":"2026-10-29T20:00:19.322Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"n/a","name":"n/a","platforms":[],"versions":[{"version":"n/a","status":"affected"}],"cpes":[],"source":"mitre","url":"https://www.cve.org/CVERecord?id=CVE-2026-107047"}],"remediation":[],"references":["https://f-droid.org/packages/com.mendhak.gpslogger/","https://github.com/mendhak/gpslogger","https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107047.md"],"sources":[{"name":"CVE","id":"CVE-2026-107047","modified":"2026-10-29T20:00:19.322Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-107047"}],"assessments":[{"source":"CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","score":7.5}],"sourceAffected":[],"observedAt":"2026-10-29T20:45:25.243Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T00:55:33.128Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T02:35:39.902Z","attemptedAt":"2026-10-30T02:35:39.902Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-30T02:35:39.661Z","attemptedAt":"2026-10-30T02:35:39.661Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-30T02:35:39.635Z","attemptedAt":"2026-10-30T02:35:39.635Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T02:35:39.484Z","attemptedAt":"2026-10-30T02:35:39.484Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-113266","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113266","modified":"Oct 29, 2026, 8:00:19 PM","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","checkedAt":"2026-10-30T02:35:39.635Z"},{"source":"GitHub Advisory Database","id":"GHSA-q747-qwr6-p3vq","url":"https://github.com/advisories/GHSA-q747-qwr6-p3vq","modified":"2026-10-29T21:31:26Z","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","checkedAt":"2026-10-30T02:35:39.661Z"},{"source":"NVD","id":"CVE-2026-107047","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107047","modified":"2026-10-29T20:17:24.890","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","checkedAt":"2026-10-30T02:35:39.902Z"}],"aiSummary":{"text":"Mendhak GPSLogger versionCode 137 has insecure permissions, allowing unauthorized attackers to manipulate the app's logging mechanism and log data. The weakness is due to incorrect permission assignment. Impact is limited to the app's logging data.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:45:06.632Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-107047"}]}}