---
id: "CVE-2026-107023"
kind: "vulnerability"
aliases: ["CVE-2026-107023"]
title: "MyBrain Android app: exported ContentProvider leaks other users' notes and tasks"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "MyBrain", "fixed": [], "affected": "3.1.0", "ecosystem": "android"}]
ecosystems: []
tags: ["android", "content-provider", "mybrain", "package"]
not_affected_if: ["different-version"]
published_at: "2026-10-29T15:17:16+00:00"
first_seen_at: "2026-10-29T15:25:38+00:00"
updated_at: "2026-10-29T15:28:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107023", "first_seen_at": "2026-10-29T15:25:38+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-29T15:28:20+00:00"}]
---

# MyBrain Android app: exported ContentProvider leaks other users' notes and tasks

The mhss1 MyBrain v3.1.0 Android app exposes its ContentProvider with insecure permissions. An unauthorized app or attacker can read another user's private notes, tasks and diary content.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- android:MyBrain affected 3.1.0 fixed ?

## How to check

- Confirm the installed MyBrain version is `3.1.0` (check the app's version in Android settings or the build's manifest `versionName`).
- Inspect the app manifest for the ContentProvider entry and whether it is exported or lacks a read permission (`android:exported`, `android:readPermission`).

## Timeline

- 2026-10-29T15:25:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107023
- 2026-10-29T15:28:20+00:00 analyst — No maintainer advisory or fix statement found; only NVD text. Repo shows later releases (up to v3.7.0, Oct 2026) but none states a fix for this CVE, so fix stays unknown. Manifest not readable via tools, so exported/permission state unconfirmed. Settle by reading the provider entry in AndroidManifest.xml of 3.1.0 vs 3.7.0, or asking maintainer.

## Documents

- [mentions] Releases · mhss1/MyBrain https://github.com/mhss1/MyBrain/releases

## From the sources

Insecure permissions in the ContentProvider component of mhss1 MyBrain v3.1.0 allows unauthorized attackers to arbitrarily read another user's private notes/tasks/diary content.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_