Skip to main content

Samsung Health EUVDEUVD-2026-55101

| CVE-2026-21076 MEDIUM
Incorrect Authorization (CWE-863)
2026-08-10 SamsungMobile GHSA-642p-5564-84rj
Authentication Bypass Samsung Samsung Mobile Samsung Health
6.9
CVSS 4.0 · Vendor: SamsungMobile
Share

Severity by source

Vendor (SamsungMobile) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.2 MEDIUM

Local attack vector with no privileges required; exploitation is read-only with no integrity or availability impact, matching the information disclosure characterization.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (SamsungMobile).

CVSS VectorVendor: SamsungMobile

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Aug 10, 2026 - 09:09 vuln.today
CVE Published
Aug 10, 2026 - 07:42 cve.org
MEDIUM 6.9

DescriptionCVE.org

Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information.

AnalysisAI

Incorrect authorization in Samsung Health prior to version 7.0.0 exposes sensitive user health data to other local applications or processes on the same device. Local attackers - including malicious co-installed apps - can exploit this flaw to read protected health information without proper permission checks. No public exploit has been identified at time of analysis, and the fix is available in version 7.0.0 per the Samsung Mobile security advisory.

Technical ContextAI

Samsung Health is a mobile health and fitness tracking application developed by Samsung Mobile, widely deployed on Samsung Android devices. The affected component suffers from an incorrect authorization flaw (the CWE is not formally specified in available data), meaning the application fails to properly enforce access controls before exposing sensitive data to local callers. The CPE string cpe:2.3:a:samsung_mobile:samsung_health:*:*:*:*:*:*:*:* indicates all versions prior to 7.0.0 are in scope. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N) indicates local access with no special attack prerequisites, no required user interaction, and no elevated privileges needed on the attacking side, while VC:H confirms high confidentiality impact on the vulnerable system.

RemediationAI

Update Samsung Health to version 7.0.0 or later, which is the vendor-confirmed fix per the Samsung Mobile Security Maintenance Release advisory at https://security.samsungmobile.com/serviceWeb.smsb?year=2026&month=08. Users on Samsung devices should ensure automatic app updates are enabled via the Galaxy Store or Google Play Store to receive this patch. As a compensating control where immediate update is not possible, restricting installation of untrusted third-party applications reduces the local attacker surface, though this does not eliminate the vulnerability. Disabling Samsung Health entirely is a high-impact workaround with obvious functional trade-offs and should only be considered in high-sensitivity environments.

More in Samsung Mobile

View all
CVE-2015-7896 MEDIUM POC
6.5 Aug 24

LibQJpeg in the Samsung Galaxy S6 before the October 2015 MR allows remote attackers to cause a denial of service (memor
CVE-2026-21085 HIGH POC
8.4 Sep 09

Out-of-bounds write in Samsung's Keymaster trustlet - a Trusted Execution Environment (TEE) component running in ARM Tru
CVE-2015-7891 HIGH POC
7.0 Aug 02

Race condition in the ioctl implementation in the Samsung Graphics 2D driver (aka /dev/fimg2d) in Samsung devices with A
CVE-2017-5538 CRITICAL
9.8 Mar 23

The kbase_dispatch function in arm/t7xx/r5p0/mali_kbase_core_linux.c in the GPU driver on Samsung devices with M(6.0) an
CVE-2016-9967 CRITICAL
9.8 Dec 16

Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5
CVE-2016-9966 CRITICAL
9.8 Dec 16

Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5
CVE-2016-9965 CRITICAL
9.8 Dec 16

Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5
CVE-2018-9143 CRITICAL
9.8 Mar 30

On Samsung mobile devices with M(6.0) and N(7.x) software, a heap overflow in the sensorhub binder service leads to code
CVE-2018-9139 CRITICAL
9.8 Mar 30

On Samsung mobile devices with N(7.x) software, a buffer overflow in the vision service allows code execution in a privi
CVE-2015-7895 MEDIUM POC
5.5 Jun 27

Samsung Gallery on the Samsung Galaxy S6 allows local users to cause a denial of service (process crash). Rated medium s
CVE-2015-7898 MEDIUM POC
5.5 Jun 27

Samsung Gallery in the Samsung Galaxy S6 allows local users to cause a denial of service (process crash). Rated medium s
CVE-2026-21102 CRITICAL
9.3 Sep 09

Local privilege escalation to root in Samsung's DualDAR (Dual Data-at-Rest) encryption component affects Samsung mobile

Same weakness CWE-863 – Incorrect Authorization

View all
CVE-2025-54253 CRITICAL POC
10.0
CVE-2025-24200 MEDIUM
6.1
CVE-2026-42016 HIGH POC
8.8
CVE-2023-21715 HIGH
7.3
CVE-2025-21480 HIGH
8.6
CVE-2025-21479 HIGH
8.6
CVE-2025-32462 HIGH POC
8.8
CVE-2017-4915 HIGH POC
7.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

EUVD-2026-55101 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy