CVE-2026-0013
published 2026-03-02CVE-2026-0013: In setupLayout of PickActivity.java, there is a possible way to start any activity as a DocumentsUI app due to a confused deputy. This could lead to local…
PriorityP345high8.4CVSS 3.1
AVLACLPRNUINSUCHIHAH
EPSS
0.16%
5.3th percentile
In setupLayout of PickActivity.java, there is a possible way to start any activity as a DocumentsUI app due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| platform | packages_apps_documentsui | >= 14:0 < 14:2026-03-01 | 14:2026-03-01 |
| platform | packages_apps_documentsui | >= 15:0 < 15:2026-03-01 | 15:2026-03-01 |
| platform | packages_apps_documentsui | >= 16-qpr2-next:0 < 16-qpr2-next:2026-03-01 | 16-qpr2-next:2026-03-01 |
| platform | packages_apps_documentsui | >= 16:0 < 16:2026-03-01 | 16:2026-03-01 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-v2w2-grhg-jf52: In setupLayout of PickActivity
ghsa_unreviewed·2026-03-02
CVE-2026-0013 [HIGH] CWE-441 GHSA-v2w2-grhg-jf52: In setupLayout of PickActivity
In setupLayout of PickActivity.java, there is a possible way to start any activity as a DocumentsUI app due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
OSV
CVE-2026-0013: In setupLayout of PickActivity
osv·2026-03-01
CVE-2026-0013 CVE-2026-0013: In setupLayout of PickActivity
In setupLayout of PickActivity.java, there is a possible way to start any activity as a DocumentsUI app due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-0013 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.4
CVE-2026-0013 [HIGH] CVE-2026-0013 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-0013 :
NixOS vulnerability analysis and mitigation
In setupLayout of PickActivity.java, there is a possible way to start any activity as a DocumentsUI app due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Source : NVD
## 8.4
Score
Published March 2, 2026
Severity HIGH
CNA Score 8.4
Affected Technologies
NixOS
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 0.1
Exploitation Probability (EPSS) N/A
Affected packages and libraries
android
Sources
NVD
Nix Severity HIGH No Fix Added at: Mar 04, 2026
## Get a CVE risk assessment
Get a prioritized view
Bugzilla
CVE-2026-58332 moodle: Email-based MFA bypass [fedora-all]
bugzilla·2026-07-28
CVE-2026-58332 [MEDIUM] CVE-2026-58332 moodle: Email-based MFA bypass [fedora-all]
CVE-2026-58332 moodle: Email-based MFA bypass [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
MSA-26-0013: Email-based MFA bypass
Description: A flaw in email-based multi-factor authentication made it
possible for a user to bypass another user's MFA token
check if using the email factor. Note: Valid login
credentials (such as username and password) were still
required to log into the account.
Issue summary: Email-based MFA bypass
Severity/Risk: Serious
Versions affected: 5.2, 5.1 to 5.1.4, 5.0 to 5.0.7, 4.5 to 4.5.11 and earlier
unsupported versions
Versions fixed: 5.2.1, 5.1.5, 5.0.8 and 4.5.12
Repor
Bugzilla
CVE-2026-58332 moodle: Email-based MFA bypass
bugzilla·2026-06-30
CVE-2026-58332 [MEDIUM] CVE-2026-58332 moodle: Email-based MFA bypass
CVE-2026-58332 moodle: Email-based MFA bypass
MSA-26-0013: Email-based MFA bypass
Description: A flaw in email-based multi-factor authentication made it
possible for a user to bypass another user's MFA token
check if using the email factor. Note: Valid login
credentials (such as username and password) were still
required to log into the account.
Issue summary: Email-based MFA bypass
Severity/Risk: Serious
Versions affected: 5.2, 5.1 to 5.1.4, 5.0 to 5.0.7, 4.5 to 4.5.11 and earlier
unsupported versions
Versions fixed: 5.2.1, 5.1.5, 5.0.8 and 4.5.12
Reported by: Brendan Heywood
Issue no.: MDL-88767
CVE identifier: Pending
2026-03-02
Published