vokibot EUVD-2026-112930

The specific prerequisite is the insecurely-permissioned, exported ShortcutDispatchActivity in vokibot versionCode 14: because the component lacks proper access control, any caller on the device can dispatch a shortcut and thereby trigger automated actions another user configured. Exploitation realistically requires the attacker to be able to send an intent to that activity - in practice a malicious or compromised app co-located on the same device, or an attacker-controlled shortcut invocation. Limiting factors: the flaw is tied specifically to versionCode 14 of a single F-Droid app, and despite the CVSS AV:N rating the Android component model makes same-device/local attacker presence the likely realistic precondition; this should be confirmed with the vendor advisory.

Signals conflict and must be weighed carefully. The input CVSS vector (AV:N/AC:L/PR:N/UI:N) yields 9.1 and implies remote, unauthenticated, network-reachable exploitation, but the vulnerable component - an Android 'ShortcutDispatchActivity' in the F-Droid app net.canvoki.vokibot with CWE-284 (Improper Access Control / insecure permissions) - points to an exported-component / inter-app access flaw that is realistically triggered locally on the device by another installed app or shortcut rather than across the network; this AV:N-versus-local discrepancy should be verified against the vendor advisory before treating it as a remote network bug. The vuln.today decision label is act_now, yet EPSS is only 0.17% (6th percentile), it is NOT in CISA KEV, and no working exploit code is identified - so the high priority label appears driven by the raw 9.1 CVSS rather than by evidence of widespread exploitation. PR:N (unauthenticated) is consistent with the 'unauthorized attackers' wording. Net assessment: a genuine access-control weakness, but the real-world risk is bounded by a tiny deployment footprint and the likely need for local/same-device attacker presence; the act_now label reflects severity scoring, while the low EPSS and absence of KEV/PoC suggest no observed mass exploitation.

A malicious or untrusted application installed on the same Android device sends a crafted intent to vokibot's improperly-permissioned ShortcutDispatchActivity, which dispatches a shortcut without verifying the caller's authorization. This lets the attacker invoke automated actions that another user had configured in the bot, without their consent. No public exploit code is identified, so this remains a described weakness rather than a demonstrated weaponized attack.