Caritas Wien Intranet (org.xinger.caritasintranet): Privacy & Security Findings

report - rfi-irfos
Skip to content

Permanent Disclosure Ledger

The discipline, demonstrated

On behalf of our research partners, we investigate publicly distributed Android and iOS apps: we decompile them, follow their code and data flows, and trace every connection to the servers it reaches. Hundreds of agents work through each app and join the technical evidence into one picture, which our specialists then review and verify.

387+
Android/iOS apps audited
Every app is decompiled at source-code level, not just scanned from outside.
1.04M+
Smali classes read
The full shipped code we have actually read, not an estimate.
262+
Critical findings recorded
Confirmed findings copied to regulators, not theoretical risks.
970+
Weak points found
Third-party tracking we have provably found inside the binary.
567+
Endpoints investigated
Real servers and countries where data actually flows.
132+
SDK instances mapped
Reusable libraries correlated across the entire corpus.
1 of 387 entries · sorted by elapsed ↓
Showing the report for Caritas Wien Intranet.
OrganisationNotifiedStatusSevIntel (click to expand)StatutesResolvedDisclosureElapsedReport
Caritas Wien Intranet
Private
2026-06-27
90d ago
Silent
Critical
A staff app for Caritas Vienna is published openly on the Google Play Store for anyone to download, yet it protects employee logins with a password scheme Microsoft itself declared obsolete in 2007, one that can be cracked in seconds. It also sends those login credentials over an unencrypted connection and exposes the addresses of its internal servers directly inside the app. When RFI-IRFOS reported this, Caritas responded with a legal cease-and-desist letter demanding the report be deleted and threatening the chairman personally, instead of fixing the underlying problem.
org.xinger.caritasintranet v1.5.1. All findings re-scored under CVSS v4.0. Internal employee app publicly available on Google Play. LM-hash auth (createLMHashedPasswordV1) reaches CRITICAL on the computed score alone: deprecated by Microsoft 2007, crackable in seconds with rainbow tables. Three internal server environments (prod/test/dev) hardcoded in production binary, including a direct link to an internal wiki - specific hostnames withheld from this public entry per ISO/IEC 29147 coordinated disclosure while unresolved. cleartextTrafficPermitted=true reaches HIGH on the computed score alone: NTLM credentials interceptable over HTTP. Internal server exposure, OneSignal (US) push, and pre-consent Firebase init correct to MEDIUM. Zero technical reply ever received across eight messages and 90 days. App serves: Caritas Wien + Magdas Hotel + Casa C + Caritas Graz. 2026-07-09: Caritas der Erzdiözese Wien (via Jank Weiler Operenyi Rechtsanwälte GmbH, Deloitte Legal network) sent a formal cease-and-desist claiming the findings "do not exist" with zero technical rebuttal, demanding a signed Unterlassungserklärung + EUR 1,800 legal fees + full deletion of this entry by 2026-07-14, and threatening suit, injunction and personal liability against RFI-IRFOS's chairman - countered same day with a full point-by-point technical rebuttal and a reciprocal declaration, DSB CC'd.
click to expand
GDPR Art. 32GDPR Art. 32
Yes
Closed
Disclosure
90d 00h 00m 00s
Published
PDF

This ledger is updated in real time as companies respond. Silence is public. Severity is scored primarily by CVSS v4.0, we reserve the right to deviate based on blast radius.