{"id":"CVE-2026-77875","title":"The application protects access through its calculator-style vault passcode, but the stored data is not bound to that authentication boundary","summary":"The application protects access through its calculator-style vault passcode, but the stored data is not bound to that authentication boundary. A local actor who can access shared external storage, such as through an authorized non-root A…","severity":"medium","cvss":6.8,"cvssVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","cwe":["CWE-922"],"vendor":"QUANTUMTECH LTD","product":"Hide Photos - Secure vault","affected":["hide_photos_-_secure_vault 4.1.0"],"published":"2026-09-19","updated":"2026-09-22","sourceUpdated":"2026-09-22T19:09:58.680","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77875","references":[{"url":"https://fluidattacks.com/advisories/grin","label":"help@fluidattacks.com"},{"url":"https://play.google.com/store/apps/details?id=com.macymind.calculatorlock","label":"help@fluidattacks.com"}],"tags":["nvd","cve.org"],"epss":0.0016,"epssPercentile":0.05656,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-20T00:05:53.218532Z"},"cvssSource":"cna","ingestedAt":"2026-09-18T23:54:36.625Z","slug":"CVE-2026-77875","body":"## Overview\n\nThe application protects access through its calculator-style vault passcode, but the stored data is not bound to that authentication boundary. A local actor who can access shared external storage, such as through an authorized non-root ADB shell or another local file-reading context with suitable storage access, can copy the SQLite database and media files directly without entering the vault passcode.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":37,"depthScoreParts":{"impact":37.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}