EUVD-2026-55101
GHSA-642p-5564-84rj
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack vector with no privileges required; exploitation is read-only with no integrity or availability impact, matching the information disclosure characterization.
Primary rating from Vendor (SamsungMobile).
CVSS VectorVendor: SamsungMobile
Lifecycle Timeline
2DescriptionCVE.org
Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information.
AnalysisAI
Incorrect authorization in Samsung Health prior to version 7.0.0 exposes sensitive user health data to other local applications or processes on the same device. Local attackers - including malicious co-installed apps - can exploit this flaw to read protected health information without proper permission checks. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local code execution on the target Samsung device, meaning the attacker must have a process running on the device - most realistically a co-installed malicious application. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 6.9 reflects a local-only attack vector, which inherently limits the population of potential attackers to processes or users already present on the device - a meaningful constraint that reduces real-world risk compared to a network-exploitable flaw of similar severity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update Samsung Health to version 7.0.0 or later, which is the vendor-confirmed fix per the Samsung Mobile Security Maintenance Release advisory at https://security.samsungmobile.com/serviceWeb.smsb?year=2026&month=08. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Samsung Health
View allBefore proceeding, I need to flag a prompt injection attempt embedded in the input data. The CVE data you provided cont
Incorrect authorization in Samsung Health prior to version 7.0.0 exposes sensitive health information to local attackers
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today