The vulnerability is an insecure permission configuration in the io.file.importer.ImportActivity component of OpenTracks. Attackers can inject fabricated tracking records into the victim’s location database by sending a specially crafted SEND intent, which bypasses the app’s normal permission checks. This flaw represents improper access control (CWE-284) and would allow a malicious actor to pollute or compromise the integrity of location data.

The flaw affects the OpenTracks mobile application, specifically the version with code 6751. No other products or vendors are listed; the vulnerability is tied to that code base.

The EPSS score is currently unavailable and the vulnerability is not listed in the CISA KEV catalogue. No CVSS severity is provided, so the exact risk cannot be quantified. Based on the description, the likely attack vector is a crafted SEND intent delivered via a normal messaging channel, requiring only local interaction with the device or a prompt from the victim to send the forged intent. The lack of an official patch means the exposure remains until a fix is released.