Insecure permissions in Fossify v1.3.0 allows unauthorized attackers to access and read another user's stored contacts.

Summary

Insecure permissions in Fossify v1.3.0 allows unauthorized attackers to access and read another user's stored contacts.

Remediation

1. Inventory every Unknown product deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Referencehttps://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107015-CVE-2026-107016.md
• Referencehttps://github.com/FossifyOrg/Contacts
• Referencehttps://github.com/kanytu/Simple-Contacts/issues/628