---
id: "CVE-2026-107038"
kind: "vulnerability"
aliases: ["CVE-2026-107038"]
title: "Yet Another UPnP Controller: exported component lets attackers read and control app data"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["android", "other", "upnp"]
not_affected_if: []
published_at: "2026-10-29T16:17:49+00:00"
first_seen_at: "2026-10-29T16:25:55+00:00"
updated_at: "2026-10-29T16:32:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107038", "first_seen_at": "2026-10-29T16:25:55+00:00"}]
---

# Yet Another UPnP Controller: exported component lets attackers read and control app data

Yet Another UPnP Controller (Android app, versionCode 50200) exposes an exported component without proper permissions. An unauthorized attacker can invoke it to access arbitrary application data and control it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed app version in the app's settings or package details; the sources name versionCode 50200 as affected

## Timeline

- 2026-10-29T16:25:55+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107038

## From the sources

Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of application data.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_