CVE-2026-18591

Deferred Deferred - Pending Action

Cleartext Credential Storage in Meesho Shopping App

Publication date: 2026-08-03

Last updated on: 2026-08-12

Assigner: VulDB

Description

A vulnerability was identified in Meesho Online Shopping App up to 20260607 on Android. Affected by this vulnerability is an unknown functionality of the component com.meesho.supply. Such manipulation of the argument user_id/phone number/email address/name leads to cleartext storage of sensitive information. The attack can be executed directly on the physical device. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-03

Last Modified

2026-08-12

Generated

2026-08-23

AI Q&A

2026-08-03

EPSS Evaluated

2026-08-22

NVD

CVE-2026-18591

EUVD

EUVD-2026-52228

Affected Vendors & Products

Vendor	Product	Version / Range
meesho	online_shopping_app	to 20260607 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-312	The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
CWE-310	Cryptographic Issues

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Meesho Online Shopping App for Android up to version 20260607. It involves the component com.meesho.supply where sensitive information like user_id, phone number, email address, or name is stored in cleartext due to improper handling of these arguments. The issue allows manipulation of these inputs, leading to exposure of sensitive data on the device.

Detection Guidance

This vulnerability involves cleartext storage of sensitive information in the Meesho Online Shopping App. To detect it, inspect app data directories for unencrypted user details like user_id, phone number, email, or name. Use Android Debug Bridge (ADB) commands: adb shell 'find /data/data/com.meesho.supply -type f -exec grep -l "user_id\|phone\|email\|name" {} \;' to search for plaintext storage. Check app logs with adb logcat for exposed sensitive data.

Impact Analysis

An attacker with physical access to the device could exploit this to retrieve sensitive information stored in cleartext. This includes personal identifiers like user IDs or contact details. The exploit is publicly available, increasing the risk of unauthorized access to your data.

Compliance Impact

This vulnerability likely violates data protection principles under GDPR and HIPAA by failing to protect sensitive personal data from unauthorized access. Cleartext storage of such data is a direct breach of compliance requirements for data confidentiality and security.

Mitigation Strategies

Update the Meesho Online Shopping App to the latest version to address the vulnerability in the com.meesho.supply component. Avoid storing sensitive information like user_id, phone number, email address, or name in cleartext on the device.

Hi! I’m here to help you understand CVE-2026-18591. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70