---
id: "CVE-2026-107035"
kind: "vulnerability"
aliases: ["CVE-2026-107035"]
title: "OMN Outline notes app: insecure permissions let attackers write into private storage"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["android", "omn-outline", "package"]
not_affected_if: []
published_at: "2026-10-29T16:17:49+00:00"
first_seen_at: "2026-10-29T16:25:55+00:00"
updated_at: "2026-10-29T16:33:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107035", "first_seen_at": "2026-10-29T16:25:55+00:00"}]
---

# OMN Outline notes app: insecure permissions let attackers write into private storage

The OMN Outline notes app for Markdown, version code 3400, has an insecure permissions flaw in its Page.java component. An unauthorized attacker can write content into another user's private storage using a crafted payload.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-29T16:25:55+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107035

## From the sources

Insecure permissions in the object/Page.java component of MBasov OMN Outline notes Markdown versionCode 3400 allows unauthorized attackers to arbitrarily write content into another user's private storage via a crafted payload.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_