---
id: "CVE-2026-107033"
kind: "vulnerability"
aliases: ["CVE-2026-107033"]
title: "Mirakel Android app: content provider lets attackers read and modify task database"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["android", "mirakel", "other"]
not_affected_if: ["unknown"]
published_at: "2026-10-29T16:17:49+00:00"
first_seen_at: "2026-10-29T16:25:55+00:00"
updated_at: "2026-10-29T16:33:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107033", "first_seen_at": "2026-10-29T16:25:55+00:00"}]
---

# Mirakel Android app: content provider lets attackers read and modify task database

The MirakelInternalContentProvider component in Mirakel v3.0 (versionCode 60) has insecure permissions. An unauthorized attacker can read and modify another user's task database.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Mirakel app version against `versionCode 60` or `v3.0`

## Timeline

- 2026-10-29T16:25:55+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107033

## From the sources

Insecure permissions in the MirakelInternalContentProvider component of Mirakel v3.0 (versionCode 60) allows unauthorized attackers to arbitrarily read and modify another user's task database.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_