CVE-2026-107014

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2026-107014", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-11-02T16:58:18.803Z", "dateReserved": "2026-10-07T00:00:00.000Z", "datePublished": "2026-10-29T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-10-29T14:39:41.536Z"}, "descriptions": [{"lang": "en", "value": "Insecure permissions in Bander Notepad (bander.notepad) versionCode 12 allow unauthorized attackers to write and read notes in another user's' note database."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://f-droid.org/archive/bander.notepad_12.apk"}, {"url": "https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107014.md"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-926", "lang": "en", "description": "CWE-926 Improper Export of Android Application Components"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-11-02T16:57:47.172073Z", "id": "CVE-2026-107014", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T16:58:18.803Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-107014", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-02T16:57:47.172073Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-926", "description": "CWE-926 Improper Export of Android Application Components"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T16:57:23.332Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://f-droid.org/archive/bander.notepad_12.apk"}, {"url": "https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107014.md"}], "descriptions": [{"lang": "en", "value": "Insecure permissions in Bander Notepad (bander.notepad) versionCode 12 allow unauthorized attackers to write and read notes in another user's' note database."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-10-29T14:39:41.536Z"}}}, "cveMetadata": {"cveId": "CVE-2026-107014", "state": "PUBLISHED", "dateUpdated": "2026-11-02T16:58:18.803Z", "dateReserved": "2026-10-07T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-10-29T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Insecure permissions in Bander Notepad (bander.notepad) versionCode 12 allow unauthorized attackers to write and read notes in another user's' note database."}], "id": "CVE-2026-107014", "lastModified": "2026-11-02T17:17:33.900", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-107014", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-02T16:57:47.172073Z", "version": "2.0.3"}}]}, "published": "2026-10-29T15:17:15.077", "references": [{"source": "cve@mitre.org", "url": "https://f-droid.org/archive/bander.notepad_12.apk"}, {"source": "cve@mitre.org", "url": "https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107014.md"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-926"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "bander.notepad: Bander Notepad: Unauthorized data access and modification via insecure permissions", "id": "2563418", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563418"}, "csaw": false, "cwe": "CWE-276", "details": ["Insecure permissions in Bander Notepad (bander.notepad) versionCode 12 allow unauthorized attackers to write and read notes in another user's' note database.", "A flaw was found in Bander Notepad. Due to insecure permission configurations, an unauthorized attacker can read and modify note databases belonging to other users. This issue leads to information disclosure and unauthorized data modification."], "name": "CVE-2026-107014", "public_date": "2026-10-29T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-107014\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-107014\nhttps://f-droid.org/archive/bander.notepad_12.apk\nhttps://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107014.md"], "statement": "This vulnerability is rated as Important because improper permission handling allows unauthorized actors to compromise both the confidentiality and integrity of stored application databases. However, Bander Notepad is a standalone mobile application for the Android platform and is not included or supported across any Red Hat enterprise distributions. As a result, standard Red Hat enterprise environments are not exposed to or affected by this issue.", "threat_severity": "Important"}

{"created": "2026-10-29T18:30:14.424868+00:00", "updated": "2026-11-06T01:30:10.873178+00:00", "vendors": []}