NoNonsense Notes CVE-2026-107037

Exploitation requires local presence on the device: a malicious or unauthorized app (or a secondary on-device user/profile) must be able to reach the improperly protected NotificationHelper component of NoNonsense Notes versionCode 72600 and supply a target note id belonging to another user, resulting in an unauthorized write. It is constrained to this specific app and version, affects integrity only (writing to notes, not reading them), and - contrary to the input's AV:N - does not appear to involve a remote network-facing service; the precise trigger within NotificationHelper (e.g., an exported component or missing permission check) is not detailed in the available sources.

The input CVSS of 7.5 (High) is driven almost entirely by AV:N (network attack vector), but that is hard to reconcile with the described mechanism: an insecure-permissions flaw in the NotificationHelper component of an Android application (NoNonsense Notes / com.nononsenseapps.notepad). Android component-permission / improper-access-control issues of this kind are typically reached locally by another app on the device or another on-device user profile, not across the network - so the network vector likely overstates real-world reach (verify with the advisory). My independent assessment lands at roughly 5.4 (Medium) once the vector is corrected to local. Impact is integrity-only: an attacker can write to another user's notes by supplying a note id, but there is no confidentiality loss (C:N) and no availability impact (A:N). On the exploitation-likelihood side the signals are weak-to-absent: there is no EPSS score in the input, the CVE is not in CISA KEV, and no public exploit is identified. The vuln.today priority is 'this_week' (not act_now/emergency). CWE-284 (improper access control / IDOR-style) fits the description. Net: this is a genuine access-control defect but, given a niche product, local vector, integrity-only impact, and absence of exploitation signals, it is a lower real-world priority than the 7.5 headline suggests - closer to a routine patch item than an urgent one.

A malicious application co-installed on the same Android device (or a local secondary user/profile) interacts with the improperly protected NotificationHelper component of NoNonsense Notes and supplies an arbitrary note id belonging to another user, overwriting or injecting content into notes the attacker should not control. No public proof-of-concept is identified, and the attack requires local presence on the device rather than remote network access, limiting its practicality.