CVE-2026-107017: Insecure permissions in the ShortcutDispatchActivity component of canvoki versionCode 14 allows unauthorized attackers to arbitrarily trigger another user's configured automated…

Unscored severity · published Oct 29, 2026

CVE-2026-107017

Insecure permissions in the ShortcutDispatchActivity component of canvoki versionCode 14 allows unauthorized attackers to arbitrarily trigger another user's configured automated…

New

–

CVSS

–

EPSS

No

On KEV

Description

Insecure permissions in the ShortcutDispatchActivity component of canvoki versionCode 14 allows unauthorized attackers to arbitrarily trigger another user's configured automated actions.

Exploitation

Is it being used?

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-107017

CVE.org

https://www.cve.org/CVERecord?id=CVE-2026-107017

f-droid.org

https://f-droid.org/packages/net.canvoki.vokibot/

github.com

https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107017.md

github.com

https://github.com/vokimon/vokibot