{"id":"CVE-2026-107035","kind":"vulnerability","aliases":["CVE-2026-107035"],"related":[],"title":"OMN Outline notes app: insecure permissions let attackers write into private storage","description":"Insecure permissions in the object/Page.java component of MBasov OMN Outline notes Markdown versionCode 3400 allows unauthorized attackers to arbitrarily write content into another user's private storage via a crafted payload.","summary":"The OMN Outline notes app for Markdown, version code 3400, has an insecure permissions flaw in its Page.java component. An unauthorized attacker can write content into another user's private storage using a crafted payload.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","omn-outline","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-29T16:17:49+00:00","first_seen_at":"2026-10-29T16:25:55+00:00","triaged_at":"2026-10-29T16:33:26+00:00","updated_at":"2026-10-29T16:33:26+00:00","category":"package","confidence":0.35,"triage":{"at":"2026-10-29T16:33:26Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"OMN Outline notes app: insecure permissions let attackers write into private storage","impact":"medium","summary":"The OMN Outline notes app for Markdown, version code 3400, has an insecure permissions flaw in its Page.java component. An unauthorized attacker can write content into another user's private storage using a crafted payload.","audience":"everyone","category":"package","nicknames":[],"who_cares":["omn-outline","android"],"confidence":0.35,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker writes content into another user's private notes storage","analyst_note":"Check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-107035 for the vendor, the fixed version and whether the attack needs network access or a shared device.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Users of the MBasov OMN Outline notes Markdown app, version code 3400, are the affected population named by the source. The sources do not say whether a server component, a sync feature or a local-only install is needed to reach the flaw, so the exposure path is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00064,"input_tokens":4099,"output_tokens":460,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107035':15A,18A '-2026':14A,17A '3400':33B,72C 'allow':73C 'android':19B 'anoth':50B,81C 'app':4A,28B 'arbitrarili':77C 'attack':8A,45B,75C 'code':32B 'compon':42B,64C 'content':48B,79C 'craft':57B,88C 'cve':13A,16A 'flaw':38B 'insecur':5A,36B,59C 'let':7A 'markdown':30B,70C 'mbasov':66C 'note':3A,27B,69C 'object/page.java':63C 'omn':1A,21B,25B,67C 'omn-outlin':20B 'outlin':2A,22B,26B,68C 'packag':23B 'page.java':41B 'payload':58B,89C 'permiss':6A,37B,60C 'privat':11A,53B,84C 'storag':12A,54B,85C 'unauthor':44B,74C 'use':55B 'user':51B,82C 'version':31B 'versioncod':71C 'via':86C 'write':9A,47B,78C","nicknames":[],"mitigations":[],"who_affected":"Users of the MBasov OMN Outline notes Markdown app, version code 3400, are the affected population named by the source. The sources do not say whether a server component, a sync feature or a local-only install is needed to reach the flaw, so the exposure path is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"first_public_at":"2026-10-29T16:17:49+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107035","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107035","severity":null,"published_at":"2026-10-29T16:17:49+00:00","modified_at":"2026-10-29T16:17:49+00:00","first_seen_at":"2026-10-29T16:25:55+00:00","fetched_at":"2026-10-29T16:25:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}