EUVD-2026-52228
GHSA-7gc3-pw6r-7mq6
Severity by source
CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Physical access required (AV:P), low local privilege needed (PR:L), only limited PII confidentiality exposed (C:L), no integrity or availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was identified in Meesho Online Shopping App up to 20260607 on Android. Affected by this vulnerability is an unknown functionality of the component com.meesho.supply. Such manipulation of the argument user_id/phone number/email address/name leads to cleartext storage of sensitive information. The attack can be executed directly on the physical device. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.
AnalysisAI
Cleartext storage of personally identifiable information in Meesho Online Shopping App (Android, versions through 20260607) exposes user_id, phone number, email address, and name in the com.meesho.supply component without encryption. Exploitation requires physical access to the device and a degree of local privilege, making this a low-severity, localized threat rather than a remote or mass-exploitation risk. A proof-of-concept is publicly available via GitHub and Google Drive, though no active exploitation has been confirmed by CISA KEV.
Technical ContextAI
CWE-312 (Cleartext Storage of Sensitive Information) identifies the root cause: the application writes sensitive user attributes - user_id, phone number, email address, and name - to on-device storage without applying encryption or secure Android data-at-rest mechanisms. The affected component, com.meesho.supply, is an internal package within the Meesho Android application (CPE: cpe:2.3:a:meesho:online_shopping_app:*:*:*:*:*:*:*:*). Android applications that fail to use Android Keystore, EncryptedSharedPreferences, or equivalent encrypted storage primitives leave PII readable to anyone who can access the application's data directory - whether via physical device access, ADB with USB debugging enabled, or device backup extraction. The CVSS 4.0 vector (AV:P/AC:L/AT:N/PR:L) confirms the physical-access constraint and low complexity once access is obtained.
RemediationAI
No vendor-released patch or fixed version has been identified at the time of this analysis; the vendor was contacted early about the disclosure per the CVE description, but no advisory or patched build is referenced in the available intelligence. Users should monitor the official Meesho app on the Google Play Store for an updated release that addresses CWE-312 in the com.meesho.supply component. As compensating controls, users should enable full-device encryption (enabled by default on Android 6.0 and later) and set a strong lock-screen PIN or biometric to prevent unauthorized physical access - this directly raises the bar for exploitation given the AV:P attack vector. Organizations with a mobile device management (MDM) policy should enforce screen-lock and enforce app allowlisting to reduce the risk from co-installed malicious apps. Developers should remediate by replacing plaintext storage with Android's EncryptedSharedPreferences or equivalent Keystore-backed encryption for all PII fields in com.meesho.supply. References: https://vuldb.com/vuln/385419, https://github.com/honestcorrupt/MEESHO-CVE_REQUEST_NEW.
Same weakness CWE-312 – Cleartext Storage of Sensitive Information
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today