CVE-2026-21123

Awaiting Analysis Awaiting Analysis - Queue

Improper Privilege Management in Samsung Locksettings

Publication date: 2026-10-12

Last updated on: 2026-10-16

Assigner: Samsung Mobile

Description

Improper privilege management in Locksettings prior to SMR Oct-2026 Release 1 allows local privileged attackers with root privilege to access data of the tied profile in before first unlock.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-12

EPSS Evaluated

2026-10-18

NVD

CVE-2026-21123

EUVD

EUVD-2026-97187

Affected Vendors & Products

Vendor	Product	Version / Range
samsung	locksettings	to smr_oct-2026_release_1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability involves improper privilege management in Locksettings before the SMR Oct-2026 Release 1. A local attacker with root privileges can access data from a tied profile before the device is unlocked for the first time.

Detection Guidance

This vulnerability requires local root access to exploit and is tied to the Locksettings component in Samsung devices. Detection would involve checking for unauthorized access to profile data before the device is unlocked. No specific commands are provided in the available context.

Impact Analysis

If exploited, this flaw allows unauthorized access to sensitive profile data on a device, potentially exposing personal or confidential information before the owner unlocks the device.

Compliance Impact

The vulnerability allows local attackers with root privileges to access data of a tied profile before first unlock. This could lead to unauthorized data exposure, potentially violating confidentiality requirements in GDPR and HIPAA.

Mitigation Strategies

Apply the SMR Oct-2026 Release 1 or later update to fix the improper privilege management issue in Locksettings.

Hi! I’m here to help you understand CVE-2026-21123. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70