{"id":"CVE-2026-107044","kind":"vulnerability","aliases":["CVE-2026-107044"],"related":[],"title":"ProjectMAXS MAXS Main Android app: insecure permissions let attackers manipulate commands","description":"Insecure permissions in ProjectMAXS MAXS Main v0.5.19 (versionCode 19) allows unauthorized attackers to arbitrarily manipulate the app's MAXS command/transport mechanism.","summary":"ProjectMAXS MAXS Main v0.5.19 (versionCode 19) has insecure permissions that let unauthorized attackers alter its command and transport mechanism. The description does not say what data or actions an attacker gains beyond that.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","maxs-main","package"],"not_affected_if":[],"how_to_check":"- Check the installed MAXS Main app version; the affected build is `v0.5.19` (versionCode `19`).","fix":null,"status":"open","published_at":"2026-10-29T17:17:56+00:00","first_seen_at":"2026-10-29T17:26:16+00:00","triaged_at":"2026-10-29T17:28:14+00:00","updated_at":"2026-10-29T17:28:14+00:00","category":"package","confidence":0.35,"triage":{"at":"2026-10-29T17:28:14Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"ProjectMAXS MAXS Main Android app: insecure permissions let attackers manipulate commands","impact":"medium","summary":"ProjectMAXS MAXS Main v0.5.19 (versionCode 19) has insecure permissions that let unauthorized attackers alter its command and transport mechanism. The description does not say what data or actions an attacker gains beyond that.","audience":"everyone","category":"package","nicknames":[],"who_cares":["maxs-main","android"],"confidence":0.35,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown; attacker can manipulate the app's command transport","analyst_note":"Check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-107044 for the CVSS score, attack vector and the specific permissions affected, and confirm whether MAXS Main is an Android app that ordinary users install.","how_to_check":"- Check the installed MAXS Main app version; the affected build is `v0.5.19` (versionCode `19`).\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"The sources only say that version 0.5.19 (versionCode 19) of the ProjectMAXS MAXS Main app is affected. Teams that install or run this app should check whether they use that build. The sources do not describe the data path or configuration that makes it exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000681,"input_tokens":4109,"output_tokens":540,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107044':14A,17A '-2026':13A,16A '19':28B,63C 'action':50B 'allow':64C 'alter':36B 'android':4A,18B 'app':5A,71C 'arbitrarili':68C 'attack':9A,35B,52B,66C 'beyond':54B 'command':11A,38B 'command/transport':74C 'cve':12A,15A 'data':48B 'descript':43B 'gain':53B 'insecur':6A,30B,55C 'let':8A,33B 'main':3A,21B,25B,60C 'manipul':10A,69C 'max':2A,20B,24B,59C,73C 'maxs-main':19B 'mechan':41B,75C 'packag':22B 'permiss':7A,31B,56C 'projectmax':1A,23B,58C 'say':46B 'transport':40B 'unauthor':34B,65C 'v0.5.19':26B,61C 'versioncod':27B,62C","nicknames":[],"mitigations":[],"who_affected":"The sources only say that version 0.5.19 (versionCode 19) of the ProjectMAXS MAXS Main app is affected. Teams that install or run this app should check whether they use that build. The sources do not describe the data path or configuration that makes it exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"first_public_at":"2026-10-29T17:17:56+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107044","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107044","severity":null,"published_at":"2026-10-29T17:17:56+00:00","modified_at":"2026-10-29T17:17:56+00:00","first_seen_at":"2026-10-29T17:26:16+00:00","fetched_at":"2026-10-29T17:26:16+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}