{"id":"CVE-2026-107045","kind":"vulnerability","aliases":["CVE-2026-107045"],"related":[],"title":"Citrine Android app: exported content provider leaks Nostr event database","description":"Insecure permissions in the CitrineContentProvider component of Citrine v3.1.0 (versionCode 62) allows unauthorized attackers to arbitrarily read another's Nostr event database.","summary":"Citrine v3.1.0 (versionCode 62), an Android Nostr client, has insecure permissions on its CitrineContentProvider component. An attacker with a malicious app installed on the same phone can read the Nostr event database stored by Citrine.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Citrine","fixed":[],"affected":"3.1.0 (versionCode 62)","ecosystem":"android"}],"ecosystems":[],"tags":["android","citrine","nostr","package"],"not_affected_if":["no-local-malicious-apps","other-versions"],"how_to_check":"Open Settings > Apps > Citrine and read the version. 3.1.0 (versionCode 62) is the listed affected build. Whether later builds are fixed is not confirmed. Developers can run 'adb shell dumpsys package com.greenart7c3.citrine' and check whether the provider com.greenart7c3.citrine.provider is exported without a readPermission that is signature-level.","fix":null,"status":"open","published_at":"2026-10-29T17:17:56+00:00","first_seen_at":"2026-10-29T17:26:16+00:00","triaged_at":"2026-10-29T17:28:12+00:00","updated_at":"2026-10-29T17:29:33+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-29T17:28:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Citrine Android app: exported content provider leaks Nostr event database","impact":"medium","summary":"Citrine v3.1.0 (versionCode 62), an Android Nostr client, has insecure permissions on its CitrineContentProvider component. An attacker with a malicious app installed on the same phone can read the Nostr event database stored by Citrine.","audience":"everyone","category":"package","nicknames":[],"who_cares":["android","citrine","nostr"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Another app on the phone reads all Nostr events stored by Citrine","analyst_note":"Check the NVD entry and the Citrine project repository for a fixed version and whether other versions are affected.","how_to_check":"- Check the installed Citrine version in the app's settings or package info; versions `3.1.0` with versionCode `62` are listed as affected.\n- unknown for other checks; the sources do not describe further steps.","plain_action":"If you use the Citrine Nostr app on Android, check its version and wait for the developer to publish a fixed release.","needs_analyst":true,"not_affected_if":["other-versions","no-local-malicious-apps"],"who_is_affected":"Only installations of Citrine v3.1.0 (versionCode 62) are described as affected. The exposure is local: another app on the same device would need to query the provider. unknown whether other versions are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000677,"input_tokens":4093,"output_tokens":535,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Check the NVD entry and the Citrine project repository for a fixed version and whether other versions are affected.","search":"'-107045':13A,16A '-2026':12A,15A '62':25B,67C 'allow':68C 'android':2A,18B,27B 'anoth':74C 'app':3A,42B 'arbitrarili':72C 'attack':38B,70C 'citrin':1A,19B,22B,56B,64C 'citrine':17A 'citrinecontentprovid':35B,61C 'client':29B 'compon':36B,62C 'content':5A 'cve':11A,14A 'databas':10A,53B,78C 'event':9A,52B,77C 'export':4A 'insecur':31B,57C 'instal':43B 'leak':7A 'malici':41B 'nostr':8A,20B,28B,51B,76C 'packag':21B 'permiss':32B,58C 'phone':47B 'provid':6A 'read':49B,73C 'store':54B 'unauthor':69C 'v3.1.0':23B,65C 'versioncod':24B,66C","nicknames":[],"mitigations":[],"who_affected":"Android users of the Citrine relay app, version 3.1.0 (versionCode 62) per NVD. Another app installed on the same phone could query the Citrine content provider and read the stored Nostr events, which may include private ones. Anyone who does not run Citrine, or has no untrusted apps on the phone, can skip it. Whether 3.1.1 to 3.2.1 or earlier versions are affected is unconfirmed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"everyone","plain_action":"If you use the Citrine Nostr app on Android, check its version and wait for the developer to publish a fixed release.","first_public_at":"2026-10-29T17:17:56+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107045","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107045","severity":null,"published_at":"2026-10-29T17:17:56+00:00","modified_at":"2026-10-29T17:17:56+00:00","first_seen_at":"2026-10-29T17:26:16+00:00","fetched_at":"2026-10-29T17:26:16+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-107045:1087","url":null,"severity":null,"published_at":"2026-10-29T17:29:33+00:00","modified_at":"2026-10-29T17:29:33+00:00","first_seen_at":"2026-10-29T17:29:33+00:00","fetched_at":"2026-10-29T17:29:33+00:00","note":"No vendor advisory found. Citrine's ContentProvider came from PR #86 (merged Jan 2 2026, adds READ_EVENTS/WRITE_EVENTS permissions). Releases 3.1.1, 3.2.0 and 3.2.1 (latest, Oct 29) list no provider or permission fix, so the fix is unknown. NVD names only 3.1.0 (versionCode 62); earlier versions with the provider, 1.0.1 and up, may also be exposed but are unconfirmed. Earlier fix-status 'none' had no vendor page behind it, so I set it to unknown. Settling it needs the manifest or CitrineContentProvider source at v3.2.1."}],"documents":[{"id":18241,"url":"https://github.com/greenart7c3/Citrine/releases","title":"Citrine releases (3.1.0 to 3.2.1 changelogs)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":18242,"url":"https://github.com/greenart7c3/Citrine/pull/86","title":"PR #86: Add ContentProvider to expose Nostr events to other apps (merged Jan 2, 2026)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}