---
id: "CVE-2026-107045"
kind: "vulnerability"
aliases: ["CVE-2026-107045"]
title: "Citrine Android app: exported content provider leaks Nostr event database"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Citrine", "fixed": [], "affected": "3.1.0 (versionCode 62)", "ecosystem": "android"}]
ecosystems: []
tags: ["android", "citrine", "nostr", "package"]
not_affected_if: ["no-local-malicious-apps", "other-versions"]
published_at: "2026-10-29T17:17:56+00:00"
first_seen_at: "2026-10-29T17:26:16+00:00"
updated_at: "2026-10-29T17:29:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107045", "first_seen_at": "2026-10-29T17:26:16+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-29T17:29:33+00:00"}]
---

# Citrine Android app: exported content provider leaks Nostr event database

Citrine v3.1.0 (versionCode 62), an Android Nostr client, has insecure permissions on its CitrineContentProvider component. An attacker with a malicious app installed on the same phone can read the Nostr event database stored by Citrine.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- android:Citrine affected 3.1.0 (versionCode 62) fixed ?

## How to check

Open Settings > Apps > Citrine and read the version. 3.1.0 (versionCode 62) is the listed affected build. Whether later builds are fixed is not confirmed. Developers can run 'adb shell dumpsys package com.greenart7c3.citrine' and check whether the provider com.greenart7c3.citrine.provider is exported without a readPermission that is signature-level.

## Timeline

- 2026-10-29T17:26:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107045
- 2026-10-29T17:29:33+00:00 analyst — No vendor advisory found. Citrine's ContentProvider came from PR #86 (merged Jan 2 2026, adds READ_EVENTS/WRITE_EVENTS permissions). Releases 3.1.1, 3.2.0 and 3.2.1 (latest, Oct 29) list no provider or permission fix, so the fix is unknown. NVD names only 3.1.0 (versionCode 62); earlier versions with the provider, 1.0.1 and up, may also be exposed but are unconfirmed. Earlier fix-status 'none' had no vendor page behind it, so I set it to unknown. Settling it needs the manifest or CitrineContentProvider source at v3.2.1.

## Documents

- [describes] PR #86: Add ContentProvider to expose Nostr events to other apps (merged Jan 2, 2026) https://github.com/greenart7c3/Citrine/pull/86
- [mentions] Citrine releases (3.1.0 to 3.2.1 changelogs) https://github.com/greenart7c3/Citrine/releases

## From the sources

Insecure permissions in the CitrineContentProvider component of Citrine v3.1.0 (versionCode 62) allows unauthorized attackers to arbitrarily read another's Nostr event database.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_