CVE-2026-18994

Deferred Deferred - Pending Action

Improper Authorization in Lenovo File Manager Android App

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: Lenovo Group Ltd.

Description

A potential improper authorization vulnerability was reported in the Lenovo File Manager Android Application, distributed exclusively in the Chinese market, that could allow a local authenticated user to read or modify protected files within the application.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-10

Last Modified

2026-09-10

Generated

2026-09-11

AI Q&A

2026-09-11

EPSS Evaluated

N/A

NVD

CVE-2026-18994

Affected Vendors & Products

Vendor	Product	Version / Range
lenovo	file_manager	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-926	The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains.

Attack-Flow Graph

Executive Summary

This vulnerability is an improper authorization issue in the Lenovo File Manager Android app, which is only distributed in the Chinese market. A local authenticated user could exploit it to read or modify protected files within the application.

Detection Guidance

This vulnerability is specific to the Lenovo File Manager Android application and requires local access. Detection would involve checking for unauthorized file access or modifications within the app's protected directories. No direct network detection commands are applicable.

Impact Analysis

If you use the Lenovo File Manager app in China, an attacker with local access could steal or alter sensitive files stored by the app, leading to data loss or unauthorized changes.

Compliance Impact

This vulnerability allows a local authenticated user to read or modify protected files within the Lenovo File Manager Android application. This could potentially lead to unauthorized access to sensitive data, which may impact compliance with standards like GDPR (data protection) and HIPAA (health information privacy) if such data is involved.

Mitigation Strategies

Update the Lenovo File Manager Android application to the latest version if an update is available. Uninstall the application if it is not required. Restrict access to sensitive files and monitor for unauthorized modifications.

Hi! I’m here to help you understand CVE-2026-18994. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70