critical9.1
CVE-2026-107017
Insecure permissions in the ShortcutDispatchActivity component of canvoki versionCode 14 allows unauthorized attackers to arbitrarily trigger another user's co…
Impact
Insecure permissions in the ShortcutDispatchActivity component of canvoki versionCode 14 allows unauthorized attackers to arbitrarily trigger another user's configured automated actions.
Affected products
| Product | Affected versions |
|---|---|
| N/A | Version n/a |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-w4r7-xv6w-rgmv
- https://nvd.nist.gov/vuln/detail/CVE-2026-107017
- https://f-droid.org/packages/net.canvoki.vokibot
- https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107017.md
- https://github.com/vokimon/vokibot
- https://f-droid.org/packages/net.canvoki.vokibot/