critical
advisory
Leaf Note: Insecure permissions arbitrary data access (CVE-2026-107034)
LeafPad / Leaf Note v1.21 (versionCode 21) contains an insecure permissions vulnerability that allows unauthorized attackers to arbitrarily read another user's note data.
CVE search metadata
CVE search record: CVE-2026-107034. Severity: critical. CVSS: 9.1. KEV: no. Product: Leaf Note (v1.21, versionCode 21). Brief: Leaf Note: Insecure permissions arbitrary data access (CVE-2026-107034). Brief link: https://feed.craftedsignal.io/briefs/2026-10-leaf-note-insecure-permissions/
Triage facts
Revision 1- Applicability
- Leaf Note (v1.21, versionCode 21)
- Evidence
- Unknown
- Severity
- Critical
- Sources
- 1 public source
- Freshness
- Revision 1Oct 30, 21:43 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
LeafPad / Leaf Note version 1.21 (versionCode 21) is affected by an insecure permissions vulnerability. This flaw allows unauthorized attackers to arbitrarily read another user's note data. The vulnerability is assigned CVE-2026-107034 and a CVSS v3.1 base score of 9.1.