canvoki: Unauthorized automated action triggering (CVE-2026-107017)
An insecure permission vulnerability in the ShortcutDispatchActivity component of canvoki version 14 allows unauthorized attackers to arbitrarily trigger another user's configured automated actions.
CVE search metadata
CVE search record: CVE-2026-107017. Severity: critical. CVSS: 9.1. KEV: no. Product: canvoki (versionCode 14). Brief: canvoki: Unauthorized automated action triggering (CVE-2026-107017). Brief link: https://feed.craftedsignal.io/briefs/2026-10-canvoki-insecure-permissions/
Triage facts
Revision 1- Applicability
- canvoki (versionCode 14)
- Evidence
- Unknown
- Severity
- Critical
- Sources
- 1 public source
- Freshness
- Revision 1Oct 30, 19:37 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
CVE-2026-107017 identifies an insecure permission vulnerability in the ShortcutDispatchActivity component of canvoki versionCode 14. This flaw allows unauthorized attackers to arbitrarily trigger automated actions configured by other users. The vulnerability has a CVSS v3.1 base score of 9.1.