ShoppingList: Exported Android activity allows unauthorized shopping list import
Summary
Version 11.0 (versionCode 11) of the ShoppingList Android app exports an import activity without permission protection. Any app installed on the same device can send a crafted shopping list to it, which is then written to the local database and shown to the user without confirmation. The attacker cannot read existing lists or run code, and the attack requires a locally installed app.
Affected
- ShoppingList Android app version 11.0 (versionCode 11)
- Version 10.0 (versionCode 10): Unknown.
Fixed in
Unknown.
Workaround
- Unknown. No vendor workaround is documented.
- Uninstall the app on business devices or stop using it for business-relevant lists until a fixed version is confirmed.
Exploitation
- No known exploitation in the wild. Not listed in CISA KEV according to a secondary source.
- The referenced advisory describes a reporter-verified proof of concept on an Android emulator. No public exploit is indexed.
- CISA SSVC: exploitation poc, automatable yes, technical impact total.
Our recommendation
- Check whether the app is installed on company or managed devices, and remove it if business lists are stored there.
- Monitor the referenced advisory and the F-Droid listing for a fixed version.
- Do not rely on imported lists until a fixed version is installed.
- Overall priority for typical SMEs: low, unless the app is used on business devices.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- F-Droid: ShoppingList package f-droid.org
- FFG0d advisory CVE-2026-107028 github.com
- ShoppingList source repository github.com
- VulDB entry 428607 vuldb.com
- OffSeq threat radar entry radar.offseq.com
- Android: Risks of exported components developer.android.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:13.
Original description (NVD)
Insecure permissions in wbpxre150 Shopping List v11.0 (versionCode 11) allows unauthorized attackers to invoke an exported component, leading to manipulation of the shopping-list data.
NVD references (4)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.