---
id: "CVE-2026-107016"
kind: "vulnerability"
aliases: ["CVE-2026-107016"]
title: "Fossify: insecure permissions let attackers read another user's stored contacts"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["fossify", "other"]
not_affected_if: []
published_at: "2026-10-29T15:17:15+00:00"
first_seen_at: "2026-10-29T15:25:38+00:00"
updated_at: "2026-10-29T15:27:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107016", "first_seen_at": "2026-10-29T15:25:38+00:00"}]
---

# Fossify: insecure permissions let attackers read another user's stored contacts

Fossify v1.3.0 sets insecure permissions on stored data, so an unauthorized attacker can read another user's contacts. The sources do not say whether the attacker needs local access or a network path.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm whether the installed Fossify version is `1.3.0`.

## Timeline

- 2026-10-29T15:25:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107016

## From the sources

Insecure permissions in Fossify v1.3.0 allows unauthorized attackers to access and read another user's stored contacts.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_