{"id":"CVE-2026-107033","kind":"vulnerability","aliases":["CVE-2026-107033"],"related":[],"title":"Mirakel Android app: content provider lets attackers read and modify task database","description":"Insecure permissions in the MirakelInternalContentProvider component of Mirakel v3.0 (versionCode 60) allows unauthorized attackers to arbitrarily read and modify another user's task database.","summary":"The MirakelInternalContentProvider component in Mirakel v3.0 (versionCode 60) has insecure permissions. An unauthorized attacker can read and modify another user's task database.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","mirakel","other"],"not_affected_if":["unknown"],"how_to_check":"- Check the installed Mirakel app version against `versionCode 60` or `v3.0`","fix":null,"status":"open","published_at":"2026-10-29T16:17:49+00:00","first_seen_at":"2026-10-29T16:25:55+00:00","triaged_at":"2026-10-29T16:33:29+00:00","updated_at":"2026-10-29T16:33:29+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-29T16:33:29Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Mirakel Android app: content provider lets attackers read and modify task database","impact":"medium","summary":"The MirakelInternalContentProvider component in Mirakel v3.0 (versionCode 60) has insecure permissions. An unauthorized attacker can read and modify another user's task database.","audience":"everyone","category":"other","nicknames":[],"who_cares":["mirakel","android"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker reads and changes another user's task data","analyst_note":"Confirm the affected versions, whether a fixed release exists, and whether the provider is reachable from other apps on the device; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-107033.","how_to_check":"- Check the installed Mirakel app version against `versionCode 60` or `v3.0`\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Users of the Mirakel task app version 3.0 (versionCode 60) on Android are affected, since the flaw is in an exported internal content provider. The sources do not say whether other versions are affected or what configuration is needed to reach the provider.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000651,"input_tokens":4092,"output_tokens":483,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107033':15A,18A '-2026':14A,17A '60':28B,54C 'allow':55C 'android':2A,19B 'anoth':39B,63C 'app':3A 'arbitrarili':59C 'attack':7A,34B,57C 'compon':23B,49C 'content':4A 'cve':13A,16A 'databas':12A,43B,67C 'insecur':30B,44C 'let':6A 'mirakel':1A,20B,25B,51C 'mirakelinternalcontentprovid':22B,48C 'modifi':10A,38B,62C 'permiss':31B,45C 'provid':5A 'read':8A,36B,60C 'task':11A,42B,66C 'unauthor':33B,56C 'user':40B,64C 'v3.0':26B,52C 'versioncod':27B,53C","nicknames":[],"mitigations":[],"who_affected":"Users of the Mirakel task app version 3.0 (versionCode 60) on Android are affected, since the flaw is in an exported internal content provider. The sources do not say whether other versions are affected or what configuration is needed to reach the provider.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"first_public_at":"2026-10-29T16:17:49+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107033","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107033","severity":null,"published_at":"2026-10-29T16:17:49+00:00","modified_at":"2026-10-29T16:17:49+00:00","first_seen_at":"2026-10-29T16:25:55+00:00","fetched_at":"2026-10-29T16:25:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}