GPSLogger CVE-2026-107047

The required prerequisite is GPSLogger (versionCode 137, package com.mendhak.gpslogger) installed on the device; the flaw is an insecure permission assignment (CWE-732) on the app's logging mechanism, letting an unauthorized party manipulate logging behavior and log data. The specific exposed component, permission, or interface and the exact trigger are not described in the available sources. Impact is limited to integrity of the app's own log data (no confidentiality or availability effect), and despite the input's AV:N, the CWE-732 class and Android app context indicate exploitation realistically requires local presence (e.g., another app on the same device) rather than remote network access - this limiting factor should be confirmed with the reporter.

The headline CVSS is 7.5 (High), driven entirely by a high integrity impact (I:H) with no confidentiality or availability impact and a claimed network, no-privilege, no-interaction vector (AV:N/AC:L/PR:N/UI:N). That vector is internally inconsistent with the nature of the flaw: this is CWE-732 (incorrect permission assignment) in an Android application (GPSLogger, distributed via F-Droid), and insecure-permissions issues in Android apps are characteristically local inter-app problems reached by another app on the same device (AV:L), not remote network attacks - the NVD-sourced AV:N should be verified with the reporter before being treated as remote. No EPSS score was provided, the CVE is not in CISA KEV, and no working exploit code is confirmed in the input (a third-party advisory file exists on GitHub but is an advisory, not verified exploit code). The vuln.today decision label is 'this_week', consistent with a real but non-emergency issue. Impact is also bounded: only the integrity of the app's own logging mechanism and recorded GPS log data is affected (C:N/A:N), so a successful attack falsifies or tampers with location logs rather than granting code execution or data theft. Net assessment: a genuine integrity flaw worth remediating this week, but the 7.5 score likely overstates real-world reach because the network vector appears mislabeled for a local Android permission issue.

An unauthorized or malicious application present on the same Android device abuses GPSLogger's insecure permission configuration to reach its logging mechanism and arbitrarily manipulate or falsify the GPS log data it records. The exact exposed component and trigger are not described in the available sources. No confirmed working exploit code was identified; only a third-party advisory reference exists.