{"id":"CVE-2026-107032","published":"2026-10-29T16:17:48.943","lastModified":"2026-10-29T21:17:10.497","description":"Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-926"],"vendors":[],"products":[],"references":[{"url":"https://f-droid.org/packages/me.alexghr.bulkshare.android.app2/","tags":[]},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107032.md","tags":[]},{"url":"https://github.com/alexghr/bulkshare","tags":[]},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107032.md","tags":[]}],"exploitRefs":[{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107032.md","tags":[]},{"url":"https://github.com/alexghr/bulkshare","tags":[]},{"url":"https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107032.md","tags":[]}],"hasPoc":true,"ai":{"summary":"Insecure permissions in Bulk Share : Location Sender v2.1.0 allow unauthenticated remote attackers to invoke an exported Android component, leading to unauthorized access to sensitive location data and control over data flow without user interaction.","exploitability":"Exploitation is trivial for remote attackers due to the absence of authentication, authorization, or user interaction requirements.","blast_radius":"Successful exploitation enables full compromise of user location privacy and potential manipulation of shared location data across devices or services relying on this app.","remediation":"Upgrade to Bulk Share : Location Sender version 2.1.1 or later, which patches the insecure exported component permissions.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["insecure-exported-component","location-leak","android","no-auth"],"model":"garnet-coder","analyzedAt":"2026-10-30T09:19:09.994Z"}}