{"id":"CVE-2026-107019","kind":"vulnerability","aliases":["CVE-2026-107019"],"related":[],"title":"Arbeitszeiterfassung2 Android app: forged holiday entries via crafted ICS import","description":"Insecure permissions in the feiertage.ImportActivity component of Arbeitszeiterfassung2 versionCode 159 allows unauthorized attackers to create forged holiday/work-time entries via crafted ICS imports.","summary":"The feiertage.ImportActivity component of the Arbeitszeiterfassung2 app (versionCode 159) has insecure permissions. A crafted ICS calendar file can make the app create forged holiday and work-time entries.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","arbeitszeiterfassung2","package"],"not_affected_if":["other-versions"],"how_to_check":"- Check whether the installed Arbeitszeiterfassung2 app has versionCode `159` (unknown how to read it from the sources; check the app's version in the Android app settings or package manager)","fix":null,"status":"open","published_at":"2026-10-29T15:17:15+00:00","first_seen_at":"2026-10-29T15:25:38+00:00","triaged_at":"2026-10-29T15:27:15+00:00","updated_at":"2026-10-29T15:27:15+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-29T15:27:15Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Arbeitszeiterfassung2 Android app: forged holiday entries via crafted ICS import","impact":"low","summary":"The feiertage.ImportActivity component of the Arbeitszeiterfassung2 app (versionCode 159) has insecure permissions. A crafted ICS calendar file can make the app create forged holiday and work-time entries.","audience":"everyone","category":"package","nicknames":[],"who_cares":["arbeitszeiterfassung2","android"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"forged holiday and work-time entries are written into the app","analyst_note":"Check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-107019 for CVSS, the fixed version and whether the ICS import needs user action.","how_to_check":"- Check whether the installed Arbeitszeiterfassung2 app has versionCode `159` (unknown how to read it from the sources; check the app's version in the Android app settings or package manager)","plain_action":"","needs_analyst":true,"not_affected_if":["other-versions"],"who_is_affected":"Only installs of the Arbeitszeiterfassung2 app at versionCode 159 are described. The sources do not say whether other versions are affected, which data path the attacker uses beyond an ICS import, or whether a person must open the file. unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000677,"input_tokens":4102,"output_tokens":533,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107019':13A,16A '-2026':12A,15A '159':28B,58C 'allow':59C 'android':2A,17B 'app':3A,26B,40B 'arbeitszeiterfassung2':1A,18B,25B,56C 'attack':61C 'calendar':35B 'compon':22B,54C 'craft':8A,33B,68C 'creat':41B,63C 'cve':11A,14A 'entri':6A,48B,66C 'feiertage.importactivity':21B,53C 'file':36B 'forg':4A,42B,64C 'holiday':5A,43B 'holiday/work-time':65C 'ic':9A,34B,69C 'import':10A,70C 'insecur':30B,49C 'make':38B 'packag':19B 'permiss':31B,50C 'time':47B 'unauthor':60C 'versioncod':27B,57C 'via':7A,67C 'work':46B 'work-tim':45B","nicknames":[],"mitigations":[],"who_affected":"Only installs of the Arbeitszeiterfassung2 app at versionCode 159 are described. The sources do not say whether other versions are affected, which data path the attacker uses beyond an ICS import, or whether a person must open the file. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"first_public_at":"2026-10-29T15:17:15+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107019","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107019","severity":null,"published_at":"2026-10-29T15:17:15+00:00","modified_at":"2026-10-29T15:17:15+00:00","first_seen_at":"2026-10-29T15:25:38+00:00","fetched_at":"2026-10-29T15:25:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}