CVE-2026-107047 in GPSLogger
Summary
by MITRE • 10/29/2026
Insecure permissions in mendhak GPSLogger versionCode 137 allows unauthorized attackers to arbitrarily manipulate the app's logging mechanism and log data.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified in Mendhak GPSLogger, specifically within application build version code 137, stems from a fundamental misconfiguration of file system permissions that grants excessive access privileges to components intended for restricted use. This insecure permission setting allows any other installed application on the same Android device to read or write data belonging to the GPSLogger app without requiring explicit user consent or proper authentication mechanisms. In mobile operating systems such as Android, applications are typically sandboxed to prevent cross-application interference; however, when an application declares overly permissive modes like world-readable or world-writable in its manifest configuration, it effectively breaks this isolation boundary. This flaw creates a direct pathway for unauthorized actors who have gained access to the device's software environment to interact with sensitive logging data that was not intended for public consumption.
From a technical perspective, the core issue lies in how the application handles storage of location history and log files. By setting permissions that allow arbitrary manipulation, the app fails to enforce strict access controls on its internal database or file structures containing geographical coordinates and timestamps. This lack of restriction means that malicious software running concurrently with GPSLogger can inject false location data into the logs or extract real-time movement patterns without detection. The ability to arbitrarily manipulate the logging mechanism implies that an attacker could alter historical records, potentially covering their own tracks by modifying past entries or creating decoy locations to mislead forensic analysis and monitoring systems dependent on this specific application's output.
The operational impact of this vulnerability is significant for users who rely on GPSLogger for security auditing, personal safety tracking, or professional logistics management. Unauthorized manipulation of log data compromises the integrity and authenticity of the recorded information. If an attacker modifies location records, it can lead to false alarms in security monitoring scenarios or inaccurate reporting in logistical operations. Furthermore, the ability to read sensitive location history poses a severe privacy risk, as detailed movement patterns over time can reveal home addresses, workplace locations, travel habits, and other personally identifiable information. This exposure violates user trust and may have legal implications depending on jurisdictional data protection regulations such as GDPR or CCPA, which mandate strict safeguards for personal geolocation data.
To mitigate this vulnerability, the application developer must immediately review and correct the AndroidManifest.xml configuration to remove any world-readable or world-writable permissions associated with internal storage files used by GPSLogger. The standard practice is to set file modes to private, ensuring that only the owning application can access its own data. Additionally, implementing content providers with proper URI permission grants for necessary external interactions can provide a secure alternative if sharing specific log segments with other trusted applications is required. Users affected by this issue should update to a patched version of the application as soon as it becomes available and consider revoking permissions from suspicious apps that may have exploited this weakness during its existence. Regular security audits focusing on file system access controls are recommended for all mobile applications handling sensitive user data to prevent similar privilege escalation or information disclosure flaws in future releases. This incident highlights the critical importance of adhering to least-privilege principles and validating permission scopes against industry standards such as CWE-276, which addresses incorrect default permissions that allow unintended actors to access restricted resources.