HarmonyOS EUVD-2026-74617

Exploitation requires local access to a HarmonyOS 6.1.0 device with a standard (low-privilege) user account - a logged-in user or a process running at the user privilege level. The app lock feature must be in active use by the device owner (i.e., at least one application must be locked via the app lock module); if no apps are locked, this vulnerability has no exploitable attack surface. The vulnerability does not require physical device access if remote shell/ADB access is available. No network-based exploitation path exists given the AV:L CVSS vector. The flaw is limited to read access (C:H/I:N/A:N), so an attacker cannot modify or delete locked app data through this vulnerability alone.

The CVSS base score of 5.5 (Medium) is consistent with a local, non-escalatable confidentiality flaw. The AV:L attack vector limits exposure to local device access, which significantly constrains the attacker population in comparison to network-reachable vulnerabilities. AC:L indicates no special conditions are needed once the attacker has local presence. PR:L confirms the exploit is accessible to any standard device user, which on a shared or multi-profile HarmonyOS device broadens the threat. The impact is strictly confidentiality (C:H/I:N/A:N), meaning app data can be read but not modified or deleted. No EPSS data, KEV status, or POC availability are provided, so real-world exploitation urgency cannot be quantified beyond the CVSS signal. The 'Privilege Escalation' tag in metadata appears imprecise - the actual impact is unauthorized read access to locked app content, which is better characterized as an access control bypass leading to information disclosure.

An attacker with physical or remote shell access to a HarmonyOS 6.1.0 device as a standard (non-admin) user crafts an action or invokes a code path that bypasses the app lock permission gate, gaining read access to data belonging to applications the device owner has designated as locked. The bypass requires no interaction from the legitimate device owner and works regardless of the specific apps locked. No public proof-of-concept has been identified at time of analysis.