Skip to main content

Samsung Health CVE-2026-21077

| EUVDEUVD-2026-55102 MEDIUM
Incorrect Authorization (CWE-863)
2026-08-10 SamsungMobile GHSA-4r4w-h2xw-494x
Authentication Bypass Samsung Samsung Mobile Samsung Health
6.9
CVSS 4.0 · Vendor: SamsungMobile
Share

Severity by source

Vendor (SamsungMobile) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.2 MEDIUM

Local vector (AV:L) with no privileges (PR:N) matches CVSS 4.0 input; confidentiality-only high impact, no integrity or availability effect, scope unchanged.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (SamsungMobile).

CVSS VectorVendor: SamsungMobile

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Aug 10, 2026 - 09:09 vuln.today
CVE Published
Aug 10, 2026 - 07:43 cve.org
MEDIUM 6.9

DescriptionCVE.org

Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information.

AnalysisAI

Incorrect authorization in Samsung Health prior to version 7.0.0 exposes sensitive health information to local attackers on Android devices. The CVSS 4.0 vector (AV:L/PR:N/VC:H) confirms a local, unprivileged attacker can bypass authorization controls to read confidential data from the Samsung Health application. No public exploit or active exploitation (KEV) has been identified at the time of analysis; the fix is upgrade to version 7.0.0 or later.

Technical ContextAI

Samsung Health (CPE: cpe:2.3:a:samsung_mobile:samsung_health:*:*:*:*:*:*:*:*) is a health and fitness tracking application pre-installed on Samsung Android devices. The vulnerability is classified as incorrect authorization - the application fails to properly enforce access control boundaries that should restrict which processes, users, or applications can read sensitive stored health data. No specific CWE was assigned by the reporter, but the flaw pattern aligns with CWE-863 (Incorrect Authorization) or CWE-732 (Incorrect Permission Assignment for Critical Resource). On Android, 'local' attack surface typically encompasses malicious co-resident applications with no special privileges, or a user with physical device access acting outside their intended authorization scope.

RemediationAI

Upgrade Samsung Health to version 7.0.0 or later, available through the Galaxy Store or Google Play. The vendor advisory is published at https://security.samsungmobile.com/serviceWeb.smsb?year=2026&month=08. If immediate upgrade is not possible, restricting the installation of untrusted or sideloaded third-party applications reduces the local attack surface by limiting the pool of co-resident processes that could exploit the authorization flaw. Additionally, enabling Android Work Profile or device management policies that sandbox application data access can serve as a compensating control, though this may affect Samsung Health functionality. There is no indication that disabling any specific Samsung Health feature mitigates the flaw without upgrading.

More in Samsung Mobile

View all
CVE-2015-7896 MEDIUM POC
6.5 Aug 24

LibQJpeg in the Samsung Galaxy S6 before the October 2015 MR allows remote attackers to cause a denial of service (memor
CVE-2026-21085 HIGH POC
8.4 Sep 09

Out-of-bounds write in Samsung's Keymaster trustlet - a Trusted Execution Environment (TEE) component running in ARM Tru
CVE-2015-7891 HIGH POC
7.0 Aug 02

Race condition in the ioctl implementation in the Samsung Graphics 2D driver (aka /dev/fimg2d) in Samsung devices with A
CVE-2017-5538 CRITICAL
9.8 Mar 23

The kbase_dispatch function in arm/t7xx/r5p0/mali_kbase_core_linux.c in the GPU driver on Samsung devices with M(6.0) an
CVE-2016-9967 CRITICAL
9.8 Dec 16

Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5
CVE-2016-9966 CRITICAL
9.8 Dec 16

Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5
CVE-2016-9965 CRITICAL
9.8 Dec 16

Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5
CVE-2018-9143 CRITICAL
9.8 Mar 30

On Samsung mobile devices with M(6.0) and N(7.x) software, a heap overflow in the sensorhub binder service leads to code
CVE-2018-9139 CRITICAL
9.8 Mar 30

On Samsung mobile devices with N(7.x) software, a buffer overflow in the vision service allows code execution in a privi
CVE-2015-7895 MEDIUM POC
5.5 Jun 27

Samsung Gallery on the Samsung Galaxy S6 allows local users to cause a denial of service (process crash). Rated medium s
CVE-2015-7898 MEDIUM POC
5.5 Jun 27

Samsung Gallery in the Samsung Galaxy S6 allows local users to cause a denial of service (process crash). Rated medium s
CVE-2026-21102 CRITICAL
9.3 Sep 09

Local privilege escalation to root in Samsung's DualDAR (Dual Data-at-Rest) encryption component affects Samsung mobile

Same weakness CWE-863 – Incorrect Authorization

View all
CVE-2025-54253 CRITICAL POC
10.0
CVE-2025-24200 MEDIUM
6.1
CVE-2026-42016 HIGH POC
8.8
CVE-2023-21715 HIGH
7.3
CVE-2025-21480 HIGH
8.6
CVE-2025-21479 HIGH
8.6
CVE-2025-32462 HIGH POC
8.8
CVE-2017-4915 HIGH POC
7.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-21077 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy