CVE-2026-107045 in Citrine
Summary
by MITRE • 10/29/2026
Insecure permissions in the CitrineContentProvider component of Citrine v3.1.0 (versionCode 62) allows unauthorized attackers to arbitrarily read another's Nostr event database.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified within the CitrineContentProvider component of Citrine version 3.1.0, specifically associated with build number sixty-two, represents a critical failure in access control mechanisms designed to protect sensitive user data. This flaw stems from an insecure configuration or implementation of file system permissions and content provider export settings that fail to enforce strict isolation between different application instances or users on the same device. In Android-based ecosystems, ContentProviders are standard components used to share structured data with other applications, but they must be meticulously configured to ensure that only authorized entities can access specific datasets. The deficiency in this particular implementation allows any installed application or local attacker without requiring elevated privileges to query and retrieve data intended for exclusive use by the legitimate user of the Citrine Nostr client.
From a technical perspective, the core issue lies in the improper assignment of read permissions on the underlying database files that store Nostr events. Typically, secure implementations would utilize private file modes or enforce explicit permission checks within the ContentProvider's query methods to verify the caller's identity and authorization level before returning any data. In this case, the absence of such safeguards means that the event database is exposed in a manner analogous to public storage. An attacker can construct simple intents or direct content URI queries to access the provider endpoint associated with Citrine. Because Nostr events often contain pseudonymous identifiers, message contents, and metadata regarding social interactions, the ability to read this data arbitrarily compromises the confidentiality of the user's communication history and network activity.
The operational impact of this vulnerability is significant for users relying on Citrine as their primary interface for interacting with the Nostr decentralized social protocol. Since Nostr events are immutable records that form the backbone of a user's digital identity within the network, unauthorized access allows an adversary to perform reconnaissance or surveillance without detection. This can lead to privacy violations where sensitive conversations, contact lists derived from relay subscriptions, and behavioral patterns are exposed. Furthermore, if the attacker gains sufficient insight into the structure of these events, they may potentially correlate this data with other leaked information sources to de-anonymize users who believe their pseudonyms provide adequate protection against identity linkage attacks.
This flaw aligns directly with Common Weakness Enumeration category CWE-732, which describes improper assignment of permissions for critical resources. It also maps to the MITRE ATT&CK framework under techniques related to Data from Local System or Unsecured Credentials if sensitive authentication tokens are stored within these events. To mitigate this risk, developers must immediately audit the AndroidManifest.xml configuration and the Java/Kotlin code implementing the CitrineContentProvider. The fix involves ensuring that exported components do not grant world-readable access unless absolutely necessary for interoperability with trusted partners who have been explicitly whitelisted. Implementing strict permission checks using Context.checkCallingPermission or verifying the calling package signature against a known list of authorized applications will restore the intended security boundary and prevent unauthorized data exfiltration from the Nostr event database.