Live › vulnerability › CVE-2026-107056
OpenTracks versionCode 6751 has an insecure permission on its io.file.importer.ImportActivity component. An attacker-controlled app can send a crafted SEND message to write forged tracks into the victim's location database.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 17:26 UTC. All times on this page are UTC.
Android users running OpenTracks versionCode 6751, where other apps on the same phone can send it crafted import requests. The sources do not say whether the component is reachable from outside the device or what the default configuration is. Users of other versions or of other tracking apps are not described as affected.
No product ranges from the sources yet.
versionCode in its build metadata; 6751 is affected per the source.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Insecure permissions in the io.file.importer.ImportActivity component of OpenTracks versionCode 6751 allows unauthorized attackers to inject crafted tracking data into the victim's location database via a crafted SEND message.
This page as .md · .json · in your agent: get_signal("CVE-2026-107056")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.