Live › vulnerability › CVE-2026-107045
Citrine v3.1.0 (versionCode 62), an Android Nostr client, has insecure permissions on its CitrineContentProvider component. An attacker with a malicious app installed on the same phone can read the Nostr event database stored by Citrine.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 17:26 UTC. All times on this page are UTC.
Android users of the Citrine relay app, version 3.1.0 (versionCode 62) per NVD. Another app installed on the same phone could query the Citrine content provider and read the stored Nostr events, which may include private ones. Anyone who does not run Citrine, or has no untrusted apps on the phone, can skip it. Whether 3.1.1 to 3.2.1 or earlier versions are affected is unconfirmed.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Citrine | android | 3.1.0 (versionCode 62) | – |
3.1.0 (versionCode 62) is the listed affected buildadb shell dumpsys package com.greenart7c3.citrine and check whether the provider com.greenart7c3.citrine.provider is exported without a readPermission that is signature-levelUnknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Insecure permissions in the CitrineContentProvider component of Citrine v3.1.0 (versionCode 62) allows unauthorized attackers to arbitrarily read another's Nostr event database.
This page as .md · .json · in your agent: get_signal("CVE-2026-107045")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.