CVE-2022-39349

CVE-2022-39349 is a sensitive information disclosure vulnerability affecting the Tasks.org Android application prior to versions 12.7.1 and 13.0.1. A malicious or compromised application on the same device could exploit a flaw in how Tasks.org handles "share" intents, forcing it to copy internal storage files to external storage. This allows third-party applications with external storage read permissions to access sensitive data, including user notes, app preferences, and encrypted CalDAV credentials. The vulnerability has a CVSS score of 5.5 (Medium) with a local attack vector and low attack complexity, leading to high confidentiality impact. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.