Live › vulnerability › CVE-2026-107021
The CardProvider content provider in the AnyMemo Android flashcard app, build versionCode 20260730, has insecure permissions. An unauthorized app or attacker can read flashcards across the user's entire memorization database.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 15:25 UTC. All times on this page are UTC.
Only installs of AnyMemo build versionCode 20260730 that expose the CardProvider component are described as affected. Other Android apps on the same device may be able to query the flashcard data. Users of other builds or of the web are not described as affected.
No product ranges from the sources yet.
20260730 in the app's Android package detailsandroid:exported and android:readPermission settings: unknown if the sources do not sayNo fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows unauthorized attackers to arbitrarily read flashcards across the user's entire memorization database.
This page as .md · .json · in your agent: get_signal("CVE-2026-107021")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.