Simple Contacts Pro EUVD-2026-112928

Exploitation requires local presence on the device running Simple Contacts Pro versionCode 107 - specifically a second device user profile or a co-resident app that leverages the application's insecure permissions on its notes database to read and write another user's notes. No special privilege or permission grant is needed and no user interaction is described, but the attacker must already be on the device; the exact exported component or file-permission setting that is misconfigured is not described in the available sources, and no fixed version is provided. This limits realistic risk to multi-user devices or devices where a malicious app can be installed, not to remote network attackers.

The input CVSS of 9.1 is driven by an AV:N (network) vector, but this conflicts with the described mechanism: 'insecure permissions' in an Android application (Simple Contacts Pro, a SimpleMobileTools/F-Droid app per the references) that let one user or co-resident app read and write another user's contact-notes database. Access-control flaws of this kind (CWE-284) are almost always exercised locally on the device, so the network vector appears inflated - verify with the vendor/advisory before treating this as remotely reachable. Setting that aside, the decision signals are consistent and point to a genuine priority on affected devices: SSVC reports Exploitation=poc, Automatable=yes, and Technical Impact=total, and the vuln.today Decision label is act_now. There is no CISA KEV listing and no EPSS score in the supplied data, so there is no confirmation of in-the-wild or widespread exploitation - the picture is 'low-complexity, automatable, PoC available, but local and not confirmed exploited.' Net: treat as act_now for deployments of the affected build, but the real-world blast radius is bounded by the local attack surface and the product's limited footprint rather than the headline 9.1.

A malicious application installed on the same device, or a secondary device user, abuses the insecurely-permissioned notes database in Simple Contacts Pro (versionCode 107) to read and modify another user's contact notes without being granted any permission. A public PoC reference exists (fdroid advisory and GitHub issue), and SSVC rates the technique automatable with total technical impact. Exploitation is low-complexity but requires local presence on the device.