{"id":"CVE-2026-107032","kind":"vulnerability","aliases":["CVE-2026-107032"],"related":[],"title":"Bulk Share Location Sender Android app: exported component leaks data","description":"Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow.","summary":"Bulk Share: Location Sender version 2.1.0 (versionCode 5), an Android app, exposes a component to other apps without proper permission checks. An unauthorized attacker can invoke it to access data and control data flow.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","bulk-share-location-sender","package"],"not_affected_if":["app-not-installed","other-versions"],"how_to_check":"- Check the installed app version in the app's settings or package details; the affected build is `2.1.0` with versionCode `5`","fix":null,"status":"open","published_at":"2026-10-29T16:17:48+00:00","first_seen_at":"2026-10-29T16:25:55+00:00","triaged_at":"2026-10-29T16:33:30+00:00","updated_at":"2026-10-29T16:33:30+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-29T16:33:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Bulk Share Location Sender Android app: exported component leaks data","impact":"medium","summary":"Bulk Share: Location Sender version 2.1.0 (versionCode 5), an Android app, exposes a component to other apps without proper permission checks. An unauthorized attacker can invoke it to access data and control data flow.","audience":"everyone","category":"package","nicknames":[],"who_cares":["android","bulk-share-location-sender"],"confidence":0.4,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker reads location-related data and controls data flow in the app","analyst_note":"Confirm the affected component, the data exposed and whether a fixed version exists, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-107032.","how_to_check":"- Check the installed app version in the app's settings or package details; the affected build is `2.1.0` with versionCode `5`\n- unknown for further steps; the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["other-versions","app-not-installed"],"who_is_affected":"Users who have Bulk Share: Location Sender version 2.1.0 (versionCode 5) installed on an Android device are the ones described. The sources do not describe server-side or other configurations. Anyone running a different version or without this app can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000671,"input_tokens":4101,"output_tokens":522,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107032':13A,16A '-2026':12A,15A '2.1.0':29B '5':31B,67C 'access':52B,80C 'allow':68C 'android':5A,17B,33B 'app':6A,34B,40B 'arbitrari':78C 'attack':47B,70C 'bulk':1A,19B,24B,61C 'bulk-share-location-send':18B 'check':44B 'compon':8A,37B,75C 'control':55B,82C 'cve':11A,14A 'data':10A,53B,56B,79C,84C 'export':7A,74C 'expos':35B 'flow':57B,85C 'insecur':58C 'invok':49B,72C 'lead':76C 'leak':9A 'locat':3A,21B,26B,63C 'packag':23B 'permiss':43B,59C 'proper':42B 'sender':4A,22B,27B,64C 'share':2A,20B,25B,62C 'unauthor':46B,69C 'v2.1.0':65C 'version':28B 'versioncod':30B,66C 'without':41B","nicknames":[],"mitigations":[],"who_affected":"Users who have Bulk Share: Location Sender version 2.1.0 (versionCode 5) installed on an Android device are the ones described. The sources do not describe server-side or other configurations. Anyone running a different version or without this app can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"first_public_at":"2026-10-29T16:17:48+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107032","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107032","severity":null,"published_at":"2026-10-29T16:17:48+00:00","modified_at":"2026-10-29T16:17:48+00:00","first_seen_at":"2026-10-29T16:25:55+00:00","fetched_at":"2026-10-29T16:25:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}