{"id":"CVE-2026-107056","kind":"vulnerability","aliases":["CVE-2026-107056"],"related":[],"title":"OpenTracks: exported import activity lets apps inject fake tracking data","description":"Insecure permissions in the io.file.importer.ImportActivity component of OpenTracks versionCode 6751 allows unauthorized attackers to inject crafted tracking data into the victim's location database via a crafted SEND message.","summary":"OpenTracks versionCode 6751 has an insecure permission on its io.file.importer.ImportActivity component. An attacker-controlled app can send a crafted SEND message to write forged tracks into the victim's location database.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","opentracks","other"],"not_affected_if":["other-versions"],"how_to_check":"- Check the installed OpenTracks version in the app's settings or `versionCode` in its build metadata; `6751` is affected per the source.","fix":null,"status":"open","published_at":"2026-10-29T17:17:58+00:00","first_seen_at":"2026-10-29T17:26:16+00:00","triaged_at":"2026-10-29T17:28:03+00:00","updated_at":"2026-10-29T17:28:03+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-29T17:28:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"OpenTracks: exported import activity lets apps inject fake tracking data","impact":"low","summary":"OpenTracks versionCode 6751 has an insecure permission on its io.file.importer.ImportActivity component. An attacker-controlled app can send a crafted SEND message to write forged tracks into the victim's location database.","audience":"everyone","category":"other","nicknames":[],"who_cares":["android","opentracks"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"forged location tracks written into the victim's tracking database","analyst_note":"Confirm the affected version range, whether ImportActivity is exported to other apps by default, and whether a fixed version exists, via the NVD entry and the OpenTracks project release notes.","how_to_check":"- Check the installed OpenTracks version in the app's settings or `versionCode` in its build metadata; `6751` is affected per the source.\n- unknown for other checks: the sources do not say.","plain_action":"If you use the OpenTracks app on Android, check its version and update it once a fixed release is published.","needs_analyst":true,"not_affected_if":["other-versions"],"who_is_affected":"Android users running OpenTracks versionCode 6751, where other apps on the same phone can send it crafted import requests. The sources do not say whether the component is reachable from outside the device or what the default configuration is. Users of other versions or of other tracking apps are not described as affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000683,"input_tokens":4096,"output_tokens":546,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107056':13A,16A '-2026':12A,15A '6751':21B,60C 'activ':4A 'allow':61C 'android':17B 'app':6A,34B 'attack':32B,63C 'attacker-control':31B 'compon':29B,56C 'control':33B 'craft':38B,66C,77C 'cve':11A,14A 'data':10A,68C 'databas':50B,74C 'export':2A 'fake':8A 'forg':43B 'import':3A 'inject':7A,65C 'insecur':24B,51C 'io.file.importer.importactivity':28B,55C 'let':5A 'locat':49B,73C 'messag':40B,79C 'opentrack':1A,18B,19B,58C 'permiss':25B,52C 'send':36B,39B,78C 'track':9A,44B,67C 'unauthor':62C 'versioncod':20B,59C 'via':75C 'victim':47B,71C 'write':42B","nicknames":[],"mitigations":[],"who_affected":"Android users running OpenTracks versionCode 6751, where other apps on the same phone can send it crafted import requests. The sources do not say whether the component is reachable from outside the device or what the default configuration is. Users of other versions or of other tracking apps are not described as affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"If you use the OpenTracks app on Android, check its version and update it once a fixed release is published.","first_public_at":"2026-10-29T17:17:58+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107056","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107056","severity":null,"published_at":"2026-10-29T17:17:58+00:00","modified_at":"2026-10-29T17:17:58+00:00","first_seen_at":"2026-10-29T17:26:16+00:00","fetched_at":"2026-10-29T17:26:16+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}