CVE-2026-107015 in Simple Contacts Pro
Summary
by MITRE • 10/29/2026
Insecure permissions in Simple Contacts Pro versionCode 107 allow unauthorized attackers to write and read notes in another user's' note database.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified in Simple Contacts Pro, specifically within application build or version code one hundred seven, represents a critical failure in Android-specific security controls regarding file system permissions. This flaw stems from an improper configuration of the internal storage mechanisms used by the application to persist user data, particularly notes associated with contact entries. In the Android operating environment, applications are generally isolated via sandboxing principles that restrict access to other apps' private directories. However, when developers fail to explicitly set restrictive file modes during database creation or modification operations, the underlying files may inherit default permissions that allow broader access than intended by the application logic. This misconfiguration effectively bypasses the expected isolation boundaries, creating a pathway for lateral movement within the device's storage layer among applications running under different user IDs but potentially sharing certain group-level read-write privileges if not properly constrained.
The technical nature of this flaw is classified as an insecure default permission or improper file access control issue. By allowing unauthorized write and read operations on another user's note database, the application exposes sensitive personal information to potential exploitation by malicious entities residing on the same device. This could include other installed applications that have been compromised via malware or rogue software seeking to harvest contact details for phishing campaigns, identity theft, or social engineering attacks. The ability to modify these notes also introduces integrity risks, where an attacker could alter critical contextual data linked to contacts, potentially leading to misinformation being displayed within the application interface or triggering downstream effects in other systems that rely on this contact information for communication routing or user profiling.
From a threat modeling perspective, this vulnerability aligns with Common Weakness Enumeration identifier CWE twenty five, which describes insecure default permissions where software creates files with overly permissive access rights. Furthermore, it maps to the ATT&CK framework technique T ten four eight, known as Exfiltration Over Alternative Protocol or more broadly under data exfiltration from local storage if the attacker can transmit this stolen data externally. The operational impact is severe for end-users who rely on Simple Contacts Pro not just for directory management but also for storing personal notes that may contain sensitive identifiers such as home addresses, private phone numbers, or confidential reminders linked to specific individuals. An adversary with physical access to the device or control over a malicious app can exploit this weakness without requiring elevated system privileges like root access, significantly lowering the barrier to entry for exploitation.
Mitigation strategies must focus on enforcing strict file isolation practices consistent with Android security best standards. The developer should ensure that all internal files created by the application are opened using Context.MODE_PRIVATE or equivalent secure modes that restrict read and write permissions exclusively to the calling application's unique user ID. Additionally, implementing Content Providers with properly configured export attributes set to false can prevent other apps from querying this data directly. Regular security audits of file handling routines and static analysis tools should be employed during development to detect such permission misconfigurations early in the lifecycle. Users affected by this vulnerability are advised to update to a patched version immediately if available, or alternatively restrict application permissions through device settings to limit network access for untrusted apps that might attempt to exploit this local storage weakness until an official fix is deployed.