External risk intelligence

MBasov OMN-Go Insecure Permissions Allow Arbitrary Data Access

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-107040

This CVE affects a mobile application (OMN-Go). The vulnerability involves an exported component within the app's local Android environment, which is not an internet-facing service, gateway, or edge endpoint. Public network reachability is not a characteristic of this component; it requires local interaction or manipulation on the device, making it effectively local or internal.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability involves insecure permissions within a mobile application, potentially allowing unauthorized access and control over data. While classified as critical, its impact is primarily within the local environment of the affected device, not through internet-facing systems. The main concern is to confirm if this specific application is in use and exposed to any relevant risks.

Mobile app flaw grants broad data access.
Verify use and potential local exposure.
Understand local risks, not broad threats.

Attack Path

How an attacker could exploit the issue

An attacker can target an application that uses insecure permissions to access sensitive information or manipulate data. This is possible because an exported component within the application can be invoked without proper authorization, potentially leading to unauthorized data access and control over data flow.

No authentication or privileges required.
Invokes an exported application component.
Leads to arbitrary data access and control.

Live Threat

Current exploitation, exposure, and threat context

Insecure permissions in MBasov OMN-Go could allow unauthorized attackers to access and control data by invoking an exported component. This could potentially lead to the exposure or manipulation of information handled by the application, depending on the app's functionality and the specific data it processes.

Application data.
Via an exported component.
Unauthorized data access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in MBasov OMN-Go affects the application itself, suggesting that the application owner or the team responsible for its development and maintenance should take the lead. The initial step is to confirm the presence and criticality of the application within your environment, identify the specific version in use, and determine its exposure to unauthorized access. Once confirmed, the application owner should plan remediation in coordination with security and infrastructure teams.

Application owners should investigate.
Verify app presence and reachability.
Plan targeted remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is MBasov OMN-Go?

OMN-Go is a mobile application, specifically available through platforms like F-Droid, designed to provide users with specific data-handling or utility functions on Android devices. It operates as a local software package rather than a server-side application.

What does CWE-926 mean for CVE-2026-107040?

CWE-926 refers to improper export of Android application components. In this CVE, it means the app has a setting that mistakenly allows other apps on the same device to trigger its internal features without permission, effectively bypassing security boundaries.

How can an attacker trigger this vulnerability?

An attacker triggers this by using a malicious or secondary app on the same device to call the improperly exported component. The bug is not triggered by normal network traffic or remote web requests, as it requires interaction within the device's local environment.

Is my organization at risk from CVE-2026-107040?

According to Halo Surface Signal, this is unlikely to be a network-based threat because the flaw is confined to the local Android environment of the mobile app. Since it is not an internet-facing gateway or server, it does not pose a traditional remote exposure risk.

How should I respond to this threat advisory?

First, inventory your mobile environment to see if OMN-Go version 26080824 is installed on any managed devices. If found, consult your security team to evaluate the sensitivity of the data the app handles and determine if a restrictive update or removal is necessary.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.