CVE-2026-86701: ManabiPocket for Parents Info Disclosure

CVE-2026-86701 Overview

CVE-2026-86701 is an improper access control vulnerability [CWE-926] in the Android application "ManabiPocket for Parents." One of the application's components is exported without adequate access restrictions. A malicious application installed on the same Android device can invoke this component through an Android Intent. Successful exploitation allows the malicious application to obtain sensitive information from ManabiPocket for Parents.

The issue requires local access and user assistance to reach the vulnerable component. It does not permit remote exploitation over the network. The vulnerability was published to the National Vulnerability Database (NVD) on 2026-09-15 and coordinated through JPCERT/CC.

Critical Impact
A co-resident malicious Android app can send a crafted Intent to the exposed component and read sensitive information stored or handled by ManabiPocket for Parents.

Affected Products

Android application "ManabiPocket for Parents"
Vulnerable component exported by the application
Android devices with the affected application installed

Discovery Timeline

2026-09-15 - CVE-2026-86701 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-86701

Vulnerability Analysis

The flaw is an improper export configuration for an Android application component in ManabiPocket for Parents. Android components such as Activities, Services, Content Providers, and Broadcast Receivers can be reached by other installed applications when declared as exported without permission checks. In this case, one such component accepts Intents from any caller and returns or exposes sensitive data.

A locally installed malicious application can craft an Intent targeting the exposed component. Because the component lacks proper access control, it processes the Intent and returns data the caller should not receive. The disclosed data is limited to information handled by the affected application, and no integrity or availability impact is reported.

Exploitation requires user assistance, such as installing the malicious application, and does not cross a security scope boundary on the device. See the JVN Security Advisory JVN72918755 and the Manabi Pocket Blog Post for vendor-supplied details.

Root Cause

The root cause is missing or insufficient access control on an exported Android component [CWE-926]. The component is reachable via Intent by any co-resident application without a required permission, signature check, or caller validation.

Attack Vector

The attack vector is local. A malicious Android application already installed on the victim device sends an Intent to the exposed component of ManabiPocket for Parents. No network access is required, and no elevated privileges are needed by the malicious application beyond standard Android app permissions.

No verified proof-of-concept code is publicly available. The vulnerability mechanism is described in prose only; consult the JVN advisory for vendor-provided technical guidance.

Detection Methods for CVE-2026-86701

Indicators of Compromise

Presence of unexpected third-party applications on managed Android devices that also have ManabiPocket for Parents installed.
Application logs from ManabiPocket for Parents showing Intents originating from package names other than the application itself or trusted system packages.
Unusual inter-process communication (IPC) activity on managed devices targeting the affected application's package.

Detection Strategies

Use Mobile Device Management (MDM) or Mobile Threat Defense (MTD) tooling to inventory devices with the vulnerable version of ManabiPocket for Parents installed.
Review installed application lists on managed devices for unsanctioned or sideloaded applications.
For enterprise-managed Android fleets, enable Google Play Protect scanning and review any flagged applications that request broad Intent capabilities.

Monitoring Recommendations

Monitor application update status through MDM to confirm devices receive the patched build once published by the vendor.
Track advisories from JVN and the Manabi Pocket announcement channel for updated version information.
Audit user reports of unexpected data disclosure or account activity tied to the affected application.

How to Mitigate CVE-2026-86701

Immediate Actions Required

Update ManabiPocket for Parents to the latest version available from the Google Play Store.
Identify all managed Android devices with the affected application installed and prioritize them for patching.
Advise users to install applications only from trusted sources and to remove unknown or unused applications.

Patch Information

Refer to the vendor announcement at the Manabi Pocket Blog Post and the JVN Security Advisory JVN72918755 for fixed version details and update instructions. No specific fixed version string is listed in the NVD entry.

Workarounds

Uninstall ManabiPocket for Parents until the patched version can be installed if sensitive data is at risk.
Restrict installation of non-store or sideloaded applications through MDM policy on managed devices.
Enable Google Play Protect to identify potentially harmful applications that could exploit exported components.

bash

# Example: use adb to list installed packages and confirm the affected app version
adb shell pm list packages | grep -i manabi
adb shell dumpsys package <package_name> | grep versionName