EUVD-2026-21791Severity by source
AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L
Lifecycle Timeline
4DescriptionCVE.org
Vulnerability of improper permission control in the theme setting module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
AnalysisAI
HarmonyOS and EMUI theme setting modules fail to enforce proper permission controls, allowing local attackers with user interaction to read sensitive system information across security boundaries. The vulnerability requires physical or local access and user interaction but can compromise confidentiality of protected data; CVSS 6.9 reflects moderate-to-high real-world risk due to local attack surface and CVSS vector showing high confidentiality impact (C:H) despite lower integrity and availability consequences.
Technical ContextAI
The vulnerability exists in the theme setting module (CWE-275: Improper Access Control / Permission Assignment) of HarmonyOS and EMUI operating systems. The root cause is inadequate permission validation when accessing or modifying theme-related settings, allowing the setting module to expose data that should be protected by stronger access controls. The CVSS vector indicates local vector attack (AV:L) with high complexity (AC:H) and user interaction requirement (UI:R), suggesting the flaw may involve UI-based theme configuration interfaces or theme file access patterns that fail to validate caller privileges before exposing sensitive attributes or system information. CPE data confirms impact across HarmonyOS (all versions noted as affected) and EMUI (all versions noted as affected) platforms.
RemediationAI
Apply the security update provided by Huawei for HarmonyOS and EMUI as detailed in the vendor bulletin at https://consumer.huawei.com/en/support/bulletin/2026/4/. Users should check their device settings under System > About phone or About tablet to confirm current OS version, then navigate to Settings > System > System update to download and install the latest available patch. For enterprise deployments, verify the exact patched version numbers from Huawei's advisory before rolling out updates, and consider staging updates to test devices first given the permission control nature of the fix. No interim workarounds are available; patching is the primary remediation path.
Permission verification vulnerability in the wpa_supplicant module Impact: Successful exploitation of this vulnerability
Permission management vulnerability in the PMS module. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Vulnerability of access permissions not being strictly verified in the APPWidget module.Successful exploitation of this
Vulnerability of permissions not being strictly verified in the window management module.Successful exploitation of this
API permission management vulnerability in the Fwk-Display module.Successful exploitation of this vulnerability may caus
Vulnerability of defects introduced in the design process in the HiviewTunner module. Rated critical severity (CVSS 9.8)
Vulnerability of out-of-bounds parameter read/write in the Wi-Fi module. Rated critical severity (CVSS 9.8), this vulner
Vulnerability of commands from the modem being intercepted in the atcmdserver module. Rated critical severity (CVSS 9.8)
Improper permission control vulnerability in the Notepad app.Successful exploitation of the vulnerability may lead to pr
Some smartphones have configuration issues. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitab
Some smartphones have the out-of-bounds write vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is r
Some smartphones have the out-of-bounds write vulnerability.Successful exploitation of this vulnerability may cause syst
Same weakness CWE-275 – Permission Issues
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today