CVE-2021-33839: Luca-App Luca

High severity, CVSS 7.5. EPSS: 2.8% chance of exploitation in the next 30 days.

Luca through 1.7.4 on Android allows remote attackers to obtain sensitive information about COVID-19 tracking because the QR code of a Public Location can be intentionally confused with the QR code of a Private Meeting.

Affected products

• Luca-App Luca: up to and including 1.7.4

Published 2021-06-04. Last modified 2026-06-17.