{"id":"CVE-2026-107021","kind":"vulnerability","aliases":["CVE-2026-107021"],"related":[],"title":"AnyMemo Android app: flashcard provider lets any app read memorization data","description":"Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows unauthorized attackers to arbitrarily read flashcards across the user's entire memorization database.","summary":"The CardProvider content provider in the AnyMemo Android flashcard app, build versionCode 20260730, has insecure permissions. An unauthorized app or attacker can read flashcards across the user's entire memorization database.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","anymemo","flashcards","package"],"not_affected_if":["no-anymemo-installed","other-builds"],"how_to_check":"- Check the installed AnyMemo build's versionCode against `20260730` in the app's Android package details\n- Inspect the app manifest for the CardProvider `android:exported` and `android:readPermission` settings: unknown if the sources do not say","fix":null,"status":"open","published_at":"2026-10-29T15:17:15+00:00","first_seen_at":"2026-10-29T15:25:38+00:00","triaged_at":"2026-10-29T15:27:11+00:00","updated_at":"2026-10-29T15:27:11+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-29T15:27:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"AnyMemo Android app: flashcard provider lets any app read memorization data","impact":"low","summary":"The CardProvider content provider in the AnyMemo Android flashcard app, build versionCode 20260730, has insecure permissions. An unauthorized app or attacker can read flashcards across the user's entire memorization database.","audience":"everyone","category":"package","nicknames":[],"who_cares":["android","anymemo","flashcards"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Any app on the device reads all stored flashcards and memorization data.","analyst_note":"Check the NVD entry and the AnyMemo project for the exported-provider manifest detail and a fixed release; the sources give no fix or severity.","how_to_check":"- Check the installed AnyMemo build's versionCode against `20260730` in the app's Android package details\n- Inspect the app manifest for the CardProvider `android:exported` and `android:readPermission` settings: unknown if the sources do not say","plain_action":"If you use the AnyMemo flashcard app on Android, check for an update from its developer; the sources do not name a fixed version.","needs_analyst":true,"not_affected_if":["other-builds","no-anymemo-installed"],"who_is_affected":"Only installs of AnyMemo build versionCode 20260730 that expose the CardProvider component are described as affected. Other Android apps on the same device may be able to query the flashcard data. Users of other builds or of the web are not described as affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000694,"input_tokens":4093,"output_tokens":570,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107021':14A,17A '-2026':13A,16A '20260730':34B,65C 'across':46B,73C 'allow':66C 'android':2A,18B,29B 'anymemo':1A,19B,28B,63C 'app':3A,8A,31B,40B 'arbitrarili':70C 'attack':42B,68C 'build':32B 'cardprovid':23B,57C 'compon':60C 'content':24B,58C 'cve':12A,15A 'data':11A 'databas':52B,79C 'entir':50B,77C 'flashcard':4A,20B,30B,45B,72C 'helloworld1':62C 'insecur':36B,53C 'let':6A 'memor':10A,51B,78C 'packag':21B 'permiss':37B,54C 'provid':5A,25B,59C 'read':9A,44B,71C 'unauthor':39B,67C 'user':48B,75C 'versioncod':33B,64C","nicknames":[],"mitigations":[],"who_affected":"Only installs of AnyMemo build versionCode 20260730 that expose the CardProvider component are described as affected. Other Android apps on the same device may be able to query the flashcard data. Users of other builds or of the web are not described as affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"If you use the AnyMemo flashcard app on Android, check for an update from its developer; the sources do not name a fixed version.","first_public_at":"2026-10-29T15:17:15+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107021","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107021","severity":null,"published_at":"2026-10-29T15:17:15+00:00","modified_at":"2026-10-29T15:17:15+00:00","first_seen_at":"2026-10-29T15:25:38+00:00","fetched_at":"2026-10-29T15:25:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}