External risk intelligence

Citrine Android App Insecure Permissions Allow Unauthorized Nostr Event Database Reading

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-107045

The vulnerability exists within an Android application component (ContentProvider) responsible for managing local database permissions. Such components are designed for inter-process communication within a local device environment and are not intended to be exposed to or reachable from the public internet.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns an issue within the Citrine application that could allow unauthorized access to sensitive user data related to Nostr events. While the vulnerability is in an Android application component, its exposure and impact are currently being assessed to determine relevance to our environment.

Insecure app permissions could expose user data.
Potential for unauthorized data access needs review.
Confirm relevance and exposure to our systems.

Attack Path

How an attacker could exploit the issue

An attacker could access sensitive user data by exploiting insecure permissions within the Citrine application's content provider. This allows them to read another user's Nostr event database without proper authorization, potentially exposing private information.

No authentication required to access.
Insecure permissions in content provider.
Unauthorized reading of event database.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, the CitrineContentProvider component could allow unauthorized access to another user's Nostr event database. Nostr events are the fundamental data structure on the Nostr network, containing user-generated content such as text posts, profile information, and calendar event details, all identified by a public key and signed for verification.

Nostr event database contents.
Unauthorized reading via component.
Exposure of user-generated content.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Citrine's CitrineContentProvider component likely impacts application owners and potentially platform teams responsible for managing Android applications. The first practical step is to identify all instances of Citrine, confirm their reachability and business criticality, and then assign ownership for remediation planning.

Application owners should own this issue.
Verify app instances and business criticality.
Plan remediation based on exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Citrine application?

Citrine is an Android application used to interact with the Nostr network. It utilizes a component called CitrineContentProvider to manage the storage and retrieval of Nostr events, which include user-generated content like text posts, profiles, and calendar information.

What does CWE-732 mean for CVE-2026-107045?

CWE-732 refers to incorrect permission assignment for critical resources. In this specific vulnerability, the CitrineContentProvider does not properly restrict who can access its underlying database, allowing unauthorized actors to read data that should be protected.

How can an attacker trigger this vulnerability?

An attacker interacts with the misconfigured CitrineContentProvider component to read the Nostr event database. This vulnerability requires access to the device's local environment where the app is installed; it is not triggered by standard network-based remote exploitation.

Do I need to worry about this if I use Citrine?

According to Halo Surface Signal, this vulnerability affects an Android component designed for local inter-process communication. Because it is not intended to be exposed to the public internet, it is very unlikely to be reachable from remote network threats.

What should I do if I have Citrine installed?

First, locate all instances of Citrine within your environment to understand where it is running. Once identified, evaluate the business criticality of those devices and prepare to apply updates or security patches provided by the developer as they become available.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.