---
id: "CVE-2026-107043"
kind: "vulnerability"
aliases: ["CVE-2026-107043"]
title: "Code Catcher app: insecure permissions let attackers manipulate SMS code capture"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["android", "code-catcher", "other"]
not_affected_if: []
published_at: "2026-10-29T17:17:56+00:00"
first_seen_at: "2026-10-29T17:26:16+00:00"
updated_at: "2026-10-29T17:28:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107043", "first_seen_at": "2026-10-29T17:26:16+00:00"}]
---

# Code Catcher app: insecure permissions let attackers manipulate SMS code capture

Code Catcher versionCode 131 has insecure permissions that let an unauthorized attacker change how the app captures SMS codes. The description does not say what an attacker can read or send once the capture is manipulated.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-29T17:26:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107043

## From the sources

Insecure permissions in Code Catcher versionCode 131 allow unauthorized attackers to arbitrarily manipulate the app's SMS-code-capture mechanism.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_