{"id":"CVE-2026-107028","kind":"vulnerability","aliases":["CVE-2026-107028"],"related":[],"title":"Shopping List Android app lets attackers alter shopping-list data","description":"Insecure permissions in wbpxre150 Shopping List v11.0 (versionCode 11) allows unauthorized attackers to invoke an exported component, leading to manipulation of the shopping-list data.","summary":"The wbpxre150 Shopping List app version 11.0 (versionCode 11) exports a component without proper permission checks. An attacker with access to the device can invoke that component and manipulate the shopping-list data.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","other","shopping-list-app"],"not_affected_if":["different-version"],"how_to_check":"- Check the installed app version is `11.0` (versionCode `11`) in the app's settings or package details.","fix":null,"status":"open","published_at":"2026-10-29T16:17:48+00:00","first_seen_at":"2026-10-29T16:25:55+00:00","triaged_at":"2026-10-29T16:33:33+00:00","updated_at":"2026-10-29T16:33:33+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-10-29T16:33:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Shopping List Android app lets attackers alter shopping-list data","impact":"low","summary":"The wbpxre150 Shopping List app version 11.0 (versionCode 11) exports a component without proper permission checks. An attacker with access to the device can invoke that component and manipulate the shopping-list data.","audience":"everyone","category":"other","nicknames":[],"who_cares":["android","shopping-list-app"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Shopping-list data is manipulated by an unauthorized invoker","analyst_note":"Check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-107028 for the vendor, fixed version and whether the exported component is reachable from other apps or the network.","how_to_check":"- Check the installed app version is `11.0` (versionCode `11`) in the app's settings or package details.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["different-version"],"who_is_affected":"Users of the wbpxre150 Shopping List Android app version 11.0 (versionCode 11). The sources do not say whether other versions are affected or whether a remote attacker can reach the exported component, only that unauthorized attackers can invoke it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.00066,"input_tokens":4097,"output_tokens":500,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107028':14A,17A '-2026':13A,16A '11':32B,66C '11.0':30B 'access':43B 'allow':67C 'alter':7A 'android':3A,18B 'app':4A,23B,28B 'attack':6A,41B,69C 'check':39B 'compon':35B,50B,74C 'cve':12A,15A 'data':11A,57B,83C 'devic':46B 'export':33B,73C 'insecur':58C 'invok':48B,71C 'lead':75C 'let':5A 'list':2A,10A,22B,27B,56B,63C,82C 'manipul':52B,77C 'permiss':38B,59C 'proper':37B 'shop':1A,9A,21B,26B,55B,62C,81C 'shopping-list':8A,54B,80C 'shopping-list-app':20B 'unauthor':68C 'v11.0':64C 'version':29B 'versioncod':31B,65C 'wbpxre150':25B,61C 'without':36B","nicknames":[],"mitigations":[],"who_affected":"Users of the wbpxre150 Shopping List Android app version 11.0 (versionCode 11). The sources do not say whether other versions are affected or whether a remote attacker can reach the exported component, only that unauthorized attackers can invoke it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"first_public_at":"2026-10-29T16:17:48+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107028","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107028","severity":null,"published_at":"2026-10-29T16:17:48+00:00","modified_at":"2026-10-29T16:17:48+00:00","first_seen_at":"2026-10-29T16:25:55+00:00","fetched_at":"2026-10-29T16:25:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}