{"id":"CVE-2026-107016","kind":"vulnerability","aliases":["CVE-2026-107016"],"related":[],"title":"Fossify: insecure permissions let attackers read another user's stored contacts","description":"Insecure permissions in Fossify v1.3.0 allows unauthorized attackers to access and read another user's stored contacts.","summary":"Fossify v1.3.0 sets insecure permissions on stored data, so an unauthorized attacker can read another user's contacts. The sources do not say whether the attacker needs local access or a network path.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fossify","other"],"not_affected_if":[],"how_to_check":"- Confirm whether the installed Fossify version is `1.3.0`.","fix":null,"status":"open","published_at":"2026-10-29T15:17:15+00:00","first_seen_at":"2026-10-29T15:25:38+00:00","triaged_at":"2026-10-29T15:27:15+00:00","updated_at":"2026-10-29T15:27:15+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-10-29T15:27:15Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Fossify: insecure permissions let attackers read another user's stored contacts","impact":"medium","summary":"Fossify v1.3.0 sets insecure permissions on stored data, so an unauthorized attacker can read another user's contacts. The sources do not say whether the attacker needs local access or a network path.","audience":"everyone","category":"other","nicknames":[],"who_cares":["fossify"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Another user's stored contacts can be read by an attacker","analyst_note":"Check the NVD entry and the Fossify project for the affected platform, the fixed version and whether access is local or remote.","how_to_check":"- Confirm whether the installed Fossify version is `1.3.0`.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Users of Fossify v1.3.0 whose contacts are stored on the affected device or service. The sources do not say which platform or configuration is exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000614,"input_tokens":4063,"output_tokens":415,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107016':14A,17A '-2026':13A,16A 'access':47B,61C 'allow':57C 'anoth':7A,33B,64C 'attack':5A,30B,44B,59C 'contact':11A,36B,68C 'cve':12A,15A 'data':26B 'fossifi':1A,18B,19B,55C 'insecur':2A,22B,52C 'let':4A 'local':46B 'need':45B 'network':50B 'path':51B 'permiss':3A,23B,53C 'read':6A,32B,63C 'say':41B 'set':21B 'sourc':38B 'store':10A,25B,67C 'unauthor':29B,58C 'user':8A,34B,65C 'v1.3.0':20B,56C 'whether':42B","nicknames":[],"mitigations":[],"who_affected":"Users of Fossify v1.3.0 whose contacts are stored on the affected device or service. The sources do not say which platform or configuration is exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"first_public_at":"2026-10-29T15:17:15+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107016","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107016","severity":null,"published_at":"2026-10-29T15:17:15+00:00","modified_at":"2026-10-29T15:17:15+00:00","first_seen_at":"2026-10-29T15:25:38+00:00","fetched_at":"2026-10-29T15:25:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}