CVE-2026-18591
Received Received - Intake

Cleartext Credential Storage in Meesho Shopping App

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: VulDB

Description
A vulnerability was identified in Meesho Online Shopping App up to 20260607 on Android. Affected by this vulnerability is an unknown functionality of the component com.meesho.supply. Such manipulation of the argument user_id/phone number/email address/name leads to cleartext storage of sensitive information. The attack can be executed directly on the physical device. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-03
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-18591
EUVD
EUVD-2026-52228

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
meesho online_shopping_app to 20260607 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-310 Cryptographic Issues
CWE-312 The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in the Meesho Online Shopping App for Android up to version 20260607. It involves the component com.meesho.supply where sensitive information like user_id, phone number, email address, or name is stored in cleartext due to improper handling of these arguments. The issue allows manipulation of these inputs, leading to exposure of sensitive data on the device.

Impact Analysis

An attacker with physical access to the device could exploit this to retrieve sensitive information stored in cleartext. This includes personal identifiers like user IDs or contact details. The exploit is publicly available, increasing the risk of unauthorized access to your data.

Compliance Impact

This vulnerability likely violates data protection principles under GDPR and HIPAA by failing to protect sensitive personal data from unauthorized access. Cleartext storage of such data is a direct breach of compliance requirements for data confidentiality and security.

Mitigation Strategies

Update the Meesho Online Shopping App to the latest version to address the vulnerability in the com.meesho.supply component. Avoid storing sensitive information like user_id, phone number, email address, or name in cleartext on the device.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18591. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart