Simple Contacts Pro: Improper export of content provider exposes private contacts
Summary
Simple Contacts Pro versionCode 107 (and according to the advisory also 108) declares an exported content provider without any permission requirement. Any app installed on the same Android device can query it and read private local contacts, including names, phone numbers, birthdays and anniversaries, if the hidden-contacts setting is enabled, which is the default. The provider is read-only, and no code execution or privilege escalation is claimed. The NVD record lists CVSS 9.1 with network attack vector, which does not match the local nature of this flaw described in the advisory.
Affected
- Simple Contacts Pro, versionCode 107
- According to the advisory, also versionCode 108 (de.ritscher.simplemobiletools.contacts.pro)
- Release name for versionCode 107 and 108: Unknown.
Fixed in
Unknown. No vendor advisory or patch was found.
Workaround
- No vendor workaround known.
- Disable the hidden-contacts setting (Show private contacts) in the app, if the app is still used.
- Uninstall the app and move contacts to an officially maintained app.
Exploitation
- Proof of concept exists: the advisory describes a working zero-permission query against the provider.
- CISA SSVC: exploitation status poc, automatable yes, technical impact total.
- Not known to be exploited in the wild; not listed in CISA KEV.
Our recommendation
- Check whether Simple Contacts Pro (especially from F-Droid, APK sites or sideloading) is installed on company or BYOD devices.
- Uninstall the app on managed devices and do not store business or client data in it.
- Monitor the vendor repository for a fix and update if an official fixed version is published.
- Priority: medium for SMEs where the app is in use; low elsewhere.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- FFG0d fdroid-android-advisories: CVE-2026-107015 / CVE-2026-107016 github.com
- SimpleMobileTools Simple-Contacts (upstream repository) github.com
- kanytu Simple-Contacts issue 628 github.com
- VulDB entry 428470 vuldb.com
- cve-daily-brief issue 129 github.com
- OffSeq Radar: CVE-2026-107015 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:14.
Original description (NVD)
Insecure permissions in Simple Contacts Pro versionCode 107 allow unauthorized attackers to write and read notes in another user's' note database.
NVD references (4)
- https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107015-CVE-2026-107016.md
- https://github.com/SimpleMobileTools/Simple-Contacts
- https://github.com/kanytu/Simple-Contacts/issues/628
- https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107015-CVE-2026-107016.md
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.