{"id":"CVE-2026-107023","kind":"vulnerability","aliases":["CVE-2026-107023"],"related":[],"title":"MyBrain Android app: exported ContentProvider leaks other users' notes and tasks","description":"Insecure permissions in the ContentProvider component of mhss1 MyBrain v3.1.0 allows unauthorized attackers to arbitrarily read another user's private notes/tasks/diary content.","summary":"The mhss1 MyBrain v3.1.0 Android app exposes its ContentProvider with insecure permissions. An unauthorized app or attacker can read another user's private notes, tasks and diary content.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"MyBrain","fixed":[],"affected":"3.1.0","ecosystem":"android"}],"ecosystems":[],"tags":["android","content-provider","mybrain","package"],"not_affected_if":["different-version"],"how_to_check":"- Confirm the installed MyBrain version is `3.1.0` (check the app's version in Android settings or the build's manifest `versionName`).\n- Inspect the app manifest for the ContentProvider entry and whether it is exported or lacks a read permission (`android:exported`, `android:readPermission`).","fix":null,"status":"open","published_at":"2026-10-29T15:17:16+00:00","first_seen_at":"2026-10-29T15:25:38+00:00","triaged_at":"2026-10-29T15:27:11+00:00","updated_at":"2026-10-29T15:28:20+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-29T15:27:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"MyBrain Android app: exported ContentProvider leaks other users' notes and tasks","impact":"high","summary":"The mhss1 MyBrain v3.1.0 Android app exposes its ContentProvider with insecure permissions. An unauthorized app or attacker can read another user's private notes, tasks and diary content.","audience":"everyone","category":"package","nicknames":[],"who_cares":["android","mybrain"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"other apps read private notes, tasks and diary entries","analyst_note":"Check the MyBrain repository or NVD entry for the affected component, fixed version and whether the provider is exported by default.","how_to_check":"- Confirm the installed MyBrain version is `3.1.0` (check the app's version in Android settings or the build's manifest `versionName`).\n- Inspect the app manifest for the ContentProvider entry and whether it is exported or lacks a read permission (`android:exported`, `android:readPermission`).","plain_action":"If you use the MyBrain app, check whether it is version 3.1.0 and wait for an update from its developer.","needs_analyst":true,"not_affected_if":["different-version"],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000651,"input_tokens":4093,"output_tokens":484,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Check the MyBrain repository or NVD entry for the affected component, fixed version and whether the provider is exported by default.","search":"'-107023':14A,17A '-2026':13A,16A 'allow':63C 'android':2A,19B,29B 'anoth':44B,69C 'app':3A,30B,39B 'arbitrarili':67C 'attack':41B,65C 'compon':58C 'content':21B,52B,74C 'content-provid':20B 'contentprovid':5A,33B,57C 'cve':12A,15A 'diari':51B 'export':4A 'expos':31B 'insecur':35B,53C 'leak':6A 'mhss1':26B,60C 'mybrain':1A,18A,23B,27B,61C 'note':9A,48B 'notes/tasks/diary':73C 'packag':24B 'permiss':36B,54C 'privat':47B,72C 'provid':22B 'read':43B,68C 'task':11A,49B 'unauthor':38B,64C 'user':8A,45B,70C 'v3.1.0':28B,62C","nicknames":[],"mitigations":[],"who_affected":"Anyone running the MyBrain (My Brain, com.mhss.app.mybrain) Android app at version 3.1.0, per NVD. Another app installed on the same phone could read notes, tasks and diary entries through the app's ContentProvider. Versions other than 3.1.0 are not named by NVD, but the maintainer has not said whether later versions fix it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"If you use the MyBrain app, check whether it is version 3.1.0 and wait for an update from its developer.","first_public_at":"2026-10-29T15:17:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107023","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107023","severity":null,"published_at":"2026-10-29T15:17:16+00:00","modified_at":"2026-10-29T15:17:16+00:00","first_seen_at":"2026-10-29T15:25:38+00:00","fetched_at":"2026-10-29T15:25:38+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-107023:1036","url":null,"severity":null,"published_at":"2026-10-29T15:28:20+00:00","modified_at":"2026-10-29T15:28:20+00:00","first_seen_at":"2026-10-29T15:28:20+00:00","fetched_at":"2026-10-29T15:28:20+00:00","note":"No maintainer advisory or fix statement found; only NVD text. Repo shows later releases (up to v3.7.0, Oct 2026) but none states a fix for this CVE, so fix stays unknown. Manifest not readable via tools, so exported/permission state unconfirmed. Settle by reading the provider entry in AndroidManifest.xml of 3.1.0 vs 3.7.0, or asking maintainer."}],"documents":[{"id":17403,"url":"https://github.com/mhss1/MyBrain/releases","title":"Releases · mhss1/MyBrain","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}