{"id":"CVE-2026-107047","kind":"vulnerability","aliases":["CVE-2026-107047"],"related":[],"title":"GPSLogger Android app: flawed permissions let attackers alter its log data","description":"Insecure permissions in mendhak GPSLogger versionCode 137 allows unauthorized attackers to arbitrarily manipulate the app's logging mechanism and log data.","summary":"GPSLogger versionCode 137 for Android grants insecure permissions that let an unauthorized app or party change how the app writes its logs. An attacker can therefore manipulate the logged location data.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","gpslogger","package"],"not_affected_if":["not-installed","other-versioncode"],"how_to_check":"- Check the installed GPSLogger version in the app's About screen or with `adb shell dumpsys package com.mendhak.gpslogger | grep versionCode`\n- Confirm whether the installed `versionCode` is `137`","fix":null,"status":"open","published_at":"2026-10-29T17:17:57+00:00","first_seen_at":"2026-10-29T17:26:16+00:00","triaged_at":"2026-10-29T17:28:12+00:00","updated_at":"2026-10-29T17:28:12+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-29T17:28:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"GPSLogger Android app: flawed permissions let attackers alter its log data","impact":"low","summary":"GPSLogger versionCode 137 for Android grants insecure permissions that let an unauthorized app or party change how the app writes its logs. An attacker can therefore manipulate the logged location data.","audience":"everyone","category":"package","nicknames":[],"who_cares":["android","gpslogger"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker alters app logs, falsifying recorded location data","analyst_note":"Confirm the affected permission, whether a local app is required, and whether a fixed versionCode exists; check the NVD entry and the GPSLogger project page.","how_to_check":"- Check the installed GPSLogger version in the app's About screen or with `adb shell dumpsys package com.mendhak.gpslogger | grep versionCode`\n- Confirm whether the installed `versionCode` is `137`","plain_action":"If you use the GPSLogger app on Android, check whether you have version code 137 and wait for the developer's update.","needs_analyst":true,"not_affected_if":["other-versionCode","not-installed"],"who_is_affected":"Only installs of GPSLogger built as versionCode 137 are described. The sources do not say which Android permissions are involved or whether an installed malicious app is required to exploit it. Teams that do not run GPSLogger on managed devices can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000685,"input_tokens":4086,"output_tokens":553,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107047':14A,17A '-2026':13A,16A '137':23B,58C 'allow':59C 'alter':8A 'android':2A,18B,25B 'app':3A,33B,39B,66C 'arbitrarili':63C 'attack':7A,44B,61C 'chang':36B 'cve':12A,15A 'data':11A,51B,72C 'flaw':4A 'gpslogger':1A,19B,21B,56C 'grant':26B 'insecur':27B,52C 'let':6A,30B 'locat':50B 'log':10A,42B,49B,68C,71C 'manipul':47B,64C 'mechan':69C 'mendhak':55C 'packag':20B 'parti':35B 'permiss':5A,28B,53C 'therefor':46B 'unauthor':32B,60C 'versioncod':22B,57C 'write':40B","nicknames":[],"mitigations":[],"who_affected":"Only installs of GPSLogger built as versionCode 137 are described. The sources do not say which Android permissions are involved or whether an installed malicious app is required to exploit it. Teams that do not run GPSLogger on managed devices can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"If you use the GPSLogger app on Android, check whether you have version code 137 and wait for the developer's update.","first_public_at":"2026-10-29T17:17:57+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107047","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107047","severity":null,"published_at":"2026-10-29T17:17:57+00:00","modified_at":"2026-10-29T17:17:57+00:00","first_seen_at":"2026-10-29T17:26:16+00:00","fetched_at":"2026-10-29T17:26:16+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}