{"id":"CVE-2026-107017","kind":"vulnerability","aliases":["CVE-2026-107017"],"related":[],"title":"canvoki Android app: insecure permissions let attackers trigger user automations","description":"Insecure permissions in the ShortcutDispatchActivity component of canvoki versionCode 14 allows unauthorized attackers to arbitrarily trigger another user's configured automated actions.","summary":"The ShortcutDispatchActivity component of canvoki versionCode 14 is exposed with insecure permissions. An unauthorized attacker can trigger another user's configured automated actions.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","canvoki","other"],"not_affected_if":["other-versions"],"how_to_check":"- Check the installed canvoki app version; the sources name versionCode 14 as affected.","fix":null,"status":"open","published_at":"2026-10-29T15:17:15+00:00","first_seen_at":"2026-10-29T15:25:38+00:00","triaged_at":"2026-10-29T15:27:15+00:00","updated_at":"2026-10-29T15:27:15+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-10-29T15:27:15Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"canvoki Android app: insecure permissions let attackers trigger user automations","impact":"medium","summary":"The ShortcutDispatchActivity component of canvoki versionCode 14 is exposed with insecure permissions. An unauthorized attacker can trigger another user's configured automated actions.","audience":"everyone","category":"other","nicknames":[],"who_cares":["canvoki","android"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker triggers victim's automated actions without authorization","analyst_note":"Confirm affected versions, the fix and how the activity is reached (NVD entry CVE-2026-107017) before relying on this entry.","how_to_check":"- Check the installed canvoki app version; the sources name versionCode 14 as affected.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["other-versions"],"who_is_affected":"The sources describe only canvoki versionCode 14 and its ShortcutDispatchActivity component. Anyone running that version may be exposed, and the sources do not say which configurations are affected or whether other versions are impacted.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000635,"input_tokens":4086,"output_tokens":453,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107017':13A,16A '-2026':12A,15A '14':25B,51C 'action':41B,63C 'allow':52C 'android':2A,17B 'anoth':36B,58C 'app':3A 'arbitrarili':56C 'attack':7A,33B,54C 'autom':10A,40B,62C 'canvoki':1A,18B,23B,49C 'compon':21B,47C 'configur':39B,61C 'cve':11A,14A 'expos':27B 'insecur':4A,29B,42C 'let':6A 'permiss':5A,30B,43C 'shortcutdispatchact':20B,46C 'trigger':8A,35B,57C 'unauthor':32B,53C 'user':9A,37B,59C 'versioncod':24B,50C","nicknames":[],"mitigations":[],"who_affected":"The sources describe only canvoki versionCode 14 and its ShortcutDispatchActivity component. Anyone running that version may be exposed, and the sources do not say which configurations are affected or whether other versions are impacted.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"first_public_at":"2026-10-29T15:17:15+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107017","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107017","severity":null,"published_at":"2026-10-29T15:17:15+00:00","modified_at":"2026-10-29T15:17:15+00:00","first_seen_at":"2026-10-29T15:25:38+00:00","fetched_at":"2026-10-29T15:25:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}