HeyCyan App CVE-2026-116106

Exploitation targets the Android FileProvider component of HeyCyan App 1.0.103, where improper access controls (CWE-284) allow unauthorized access to files the provider should protect. The precise trigger is not described in the available sources. Realistically this class of flaw requires a malicious application co-resident on the same device to interact with the exported/misconfigured FileProvider, which limits exploitation to devices where such an app is installed - contradicting the input's 'remote' claim. Limiting factors: the specific affected build (1.0.103), the small installed base of this app, and the Low-rated impact scope (constrained file read/write, no availability effect). No vendor-confirmed configuration prerequisites are available because the vendor did not respond.

This is a medium-severity issue (CVSS 4.0 base 6.9) with no sign of being a high-priority emergency. Key signals: no CISA KEV listing (not confirmed actively exploited), no EPSS score provided in the input (exploitation probability cannot be quantified from available data), and a public PoC reference exists on GitHub but is not verified as working exploit code. The vuln.today decision label is 'this_month' - not act_now or emergency - which aligns with routine remediation rather than urgent patching. A significant conflict must be flagged: the supplied CVSS 4.0 vector claims a network attack vector (AV:N) and the description says 'the attack may be initiated remotely,' yet the component is an Android FileProvider with a CWE-284 improper-access-control weakness; such flaws are characteristically abused by a co-resident malicious app on the same device (a local vector), not by an unauthenticated network attacker - verify the true vector with the vendor or researcher. The impact is uniformly rated Low across confidentiality, integrity, and availability (VC:L/VI:L/VA:L), consistent with constrained file-level exposure rather than full device compromise. Net: a real but low-urgency issue, more a hygiene fix than a priority, and the 'remote' framing should be treated skeptically.

A malicious or trojanized app installed alongside HeyCyan 1.0.103 on the same Android device abuses the misconfigured FileProvider to read or write files that should be protected by access controls, exposing limited app data. A public PoC reference exists on GitHub (azurejoga/heycyan-vulnerabilitys) but is not verified as working exploit code. The input's 'remote' characterization is doubtful for a FileProvider access-control flaw, which typically requires a co-located application rather than purely network access.