CVE-2026-107019
Deferred Deferred - Pending Action

Insecure Permissions in Arbeitszeiterfassung2 Allow Forged Entries

Publication date: 2026-10-29

Last updated on: 2026-10-29

Assigner: MITRE

Description
Insecure permissions in the feiertage.ImportActivity component of Arbeitszeiterfassung2 versionCode 159 allows unauthorized attackers to create forged holiday/work-time entries via crafted ICS imports.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-29
Last Modified
2026-10-29
Generated
2026-10-29
AI Q&A
2026-10-29
EPSS Evaluated
N/A
NVD
CVE-2026-107019
EUVD
EUVD-2026-112932

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
n/a n/a n/a

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves insecure permissions in the feiertage.ImportActivity component of Arbeitszeiterfassung2 versionCode 159. It allows unauthorized attackers to create fake holiday or work-time entries by exploiting improper handling of ICS (iCalendar) imports without requiring user confirmation or permissions.

Detection Guidance

Check if the Arbeitszeiterfassung2 app version is 159 or lower. Look for unauthorized holiday/work-time entries in the app's database. Inspect exported ICS files for suspicious content. Review installed apps for any with access to the vulnerable ImportActivity component.

Impact Analysis

An attacker could inject false holiday or work-time entries into your database without your knowledge or consent. This could distort your recorded working hours, overtime, or absences, potentially leading to incorrect payroll, compliance violations, or disputes with employers.

Compliance Impact

This vulnerability could lead to inaccurate time records, which may violate compliance requirements for data integrity in GDPR or HIPAA. Incorrect records could result in legal or financial penalties if audits reveal tampered data.

Mitigation Strategies

Uninstall or disable the Arbeitszeiterfassung2 app if using version 159 or lower. Avoid importing ICS files from untrusted sources. Monitor the app's database for unauthorized entries. Wait for an official update from the developer to patch the vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107019. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart