CVE-2026-5454: GRID Organiser App co.gridapp.organiser app.json hard-coded key

Severity: low (CVSS 3.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-03 · updated 2026-07-24
Weakness: CWE-320

Description

A vulnerability was found in GRID Organiser App up to 1.0.5 on Android. Impacted is an unknown function of the file file res/raw/app.json of the component co.gridapp.organiser. Performing a manipulation of the argument SegmentWriteKey results in use of hard-coded cryptographic key . The attack is only possible with local access. The exploit has been made public and could be used.

Affected products

GRID Organiser App: 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5

References

https://vuldb.com/submit/781759
https://vuldb.com/vuln/355042
https://vuldb.com/vuln/355042/cti
https://www.notion.so/Segment-Write-Key-Exposure-Leading-to-Data-Injection-and-User-Profile-Manipulation-In-co-gridapp-org-3262de3f97fb801b9173c4851c7ad864?source=copy_link

Get alerted when CVE-2026-5454 or the next vulnerability affects your stack