NoNonsense Notes: Insecure permissions allow unauthorized note changes
NoNonsense Notes for Android, version 72600 (7.2.6), exports two broadcast receivers that accept a note ID from the caller without checking who sent it. Any app installed on the same device, without any runtime permissions, can mark other notes as completed or not completed. The advisory reports write access only, with no read channel, and the reminder delete and snooze actions were not tested.
NoNonsenseApps · NoNonsense Notes
