CVE-2026-107019: Security vulnerability

Published Oct 29, 2026

Updated

Insecure permissions in the feiertage.ImportActivity component of Arbeitszeiterfassung2 versionCode 159 allows unauthorized attackers to create forged holiday/work-time entries via crafted ICS imports.

Event History

Oct 29, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·03:17 PM

Description

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The issue is described as exploitable by unauthorized attackers through a crafted ICS import. The available data does not state that the attacker needs an account or elevated privileges.

What records can be manipulated through exploitation?

A crafted ICS import can be used to create forged holiday or work-time entries. The data does not indicate whether existing entries can be changed or deleted.

Which release is identified as affected?

The affected release identified in the available data is Arbeitszeiterfassung2 versionCode 159.

CVE-2026-107019: Security vulnerability

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What records can be manipulated through exploitation?

Which release is identified as affected?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What records can be manipulated through exploitation?

Which release is identified as affected?