Live › vulnerability › CVE-2026-107023
The mhss1 MyBrain v3.1.0 Android app exposes its ContentProvider with insecure permissions. An unauthorized app or attacker can read another user's private notes, tasks and diary content.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 15:25 UTC. All times on this page are UTC.
Anyone running the MyBrain (My Brain, com.mhss.app.mybrain) Android app at version 3.1.0, per NVD. Another app installed on the same phone could read notes, tasks and diary entries through the app's ContentProvider. Versions other than 3.1.0 are not named by NVD, but the maintainer has not said whether later versions fix it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| MyBrain | android | 3.1.0 | – |
3.1.0 (check the app's version in Android settings or the build's manifest versionName).android:exported, android:readPermission).No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Insecure permissions in the ContentProvider component of mhss1 MyBrain v3.1.0 allows unauthorized attackers to arbitrarily read another user's private notes/tasks/diary content.
This page as .md · .json · in your agent: get_signal("CVE-2026-107023")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.