---
id: "CVE-2026-107044"
kind: "vulnerability"
aliases: ["CVE-2026-107044"]
title: "ProjectMAXS MAXS Main Android app: insecure permissions let attackers manipulate commands"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["android", "maxs-main", "package"]
not_affected_if: []
published_at: "2026-10-29T17:17:56+00:00"
first_seen_at: "2026-10-29T17:26:16+00:00"
updated_at: "2026-10-29T17:28:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107044", "first_seen_at": "2026-10-29T17:26:16+00:00"}]
---

# ProjectMAXS MAXS Main Android app: insecure permissions let attackers manipulate commands

ProjectMAXS MAXS Main v0.5.19 (versionCode 19) has insecure permissions that let unauthorized attackers alter its command and transport mechanism. The description does not say what data or actions an attacker gains beyond that.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed MAXS Main app version; the affected build is `v0.5.19` (versionCode `19`).

## Timeline

- 2026-10-29T17:26:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107044

## From the sources

Insecure permissions in ProjectMAXS MAXS Main v0.5.19 (versionCode 19) allows unauthorized attackers to arbitrarily manipulate the app's MAXS command/transport mechanism.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_