CVE-2026-107038: Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control…

Unscored severity · published Oct 29, 2026

CVE-2026-107038

Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control…

New

–

CVSS

–

EPSS

No

On KEV

Description

Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of application data.

Exploitation

Is it being used?

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-107038

CVE.org

https://www.cve.org/CVERecord?id=CVE-2026-107038

f-droid.org

https://f-droid.org/packages/de.yaacc/

github.com

https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107038.md

github.com

https://github.com/cbejr/yaacc