---
id: "CVE-2026-107021"
kind: "vulnerability"
aliases: ["CVE-2026-107021"]
title: "AnyMemo Android app: flashcard provider lets any app read memorization data"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["android", "anymemo", "flashcards", "package"]
not_affected_if: ["no-anymemo-installed", "other-builds"]
published_at: "2026-10-29T15:17:15+00:00"
first_seen_at: "2026-10-29T15:25:38+00:00"
updated_at: "2026-10-29T15:27:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107021", "first_seen_at": "2026-10-29T15:25:38+00:00"}]
---

# AnyMemo Android app: flashcard provider lets any app read memorization data

The CardProvider content provider in the AnyMemo Android flashcard app, build versionCode 20260730, has insecure permissions. An unauthorized app or attacker can read flashcards across the user's entire memorization database.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed AnyMemo build's versionCode against `20260730` in the app's Android package details
- Inspect the app manifest for the CardProvider `android:exported` and `android:readPermission` settings: unknown if the sources do not say

## Timeline

- 2026-10-29T15:25:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107021

## From the sources

Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows unauthorized attackers to arbitrarily read flashcards across the user's entire memorization database.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_