CVE-2022-0732

7.5 highEPSS 2.5%

The backend infrastructure shared by multiple mobile device monitoring services does not adequately authenticate or authorize API requests, creating an IDOR (Insecure Direct Object Reference) vulnerability.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 2.5% chance of exploitation in the next 30 days; higher than 84% of CVEs (scores of 2026-10-31)
CWEs: CWE-639, CWE-284
Published: 2022-02-24
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

1byte:copy9
1byte:exactspy
1byte:fonetracker
1byte:guestspy
1byte:ispyoo
1byte:mxspy
1byte:secondclone
1byte:the_truth_spy
1byte:thespyapp

References

https://cwe.mitre.org/data/definitions/284.html
https://kb.cert.org/vuls/id/229438
https://techcrunch.com/2022/02/22/stalkerware-network-spilling-data/
https://www.kb.cert.org/vuls/id/229438
https://cwe.mitre.org/data/definitions/284.html

Check your stack JSON