SECURITYCRITICALCVE-2026-107015

CVE-2026-107015: Simple Contacts Pro Insecure Permissions Exposes User Notes

Insecure permissions in Simple Contacts Pro versionCode 107 let unauthorized attackers read and write notes in another user's note database (CVSS 9.1).

Dylan H.

Security Team

October 30, 2026
2 min read
CVE-2026-107015: Simple Contacts Pro Insecure Permissions Exposes User Notes

Critical severity

Rated critical. Prioritise patching — see the remediation guidance below.

Affected Products

  • Simple Contacts Pro versionCode 107

Executive Summary

CVE-2026-107015 is an insecure-permissions vulnerability in Simple Contacts Pro (versionCode 107), published to the NVD on October 29, 2026 with a CVSS score of 9.1. Per the NVD description, unauthorized attackers can write and read notes in another user's note database.

Details

FieldValue
CVECVE-2026-107015
ProductSimple Contacts Pro
AffectedversionCode 107
CVSS9.1
ImpactUnauthorized read and write of another user's notes
Published2026-10-29

The NVD entry gives only a brief description. No patch version, proof of concept, or exploitation reports were available at the time of writing.

Impact

Notes stored in a contacts app can hold sensitive material such as personal details, account hints, or business information. An attacker able to modify them could also tamper with stored data. Because the weakness is a permissions failure on the notes database, other apps or local actors may be able to reach it without the owner's consent.

Recommended Actions

  1. Check whether Simple Contacts Pro versionCode 107 is installed on managed devices.
  2. Watch the vendor's release channel for a fixed build and update when available.
  3. Until then, avoid storing sensitive information in the app's notes and consider removing the app from managed devices.
  4. Track the NVD entry for updated details and references.

References

  • NVD — CVE-2026-107015