CVE-2026-77875
Received Received - Intake

Vault Data Exposure in Calculator App via External Storage

Publication date: 2026-09-19

Last updated on: 2026-09-20

Assigner: Fluid Attacks

Description
The application protects access through its calculator-style vault passcode, but the stored data is not bound to that authentication boundary. A local actor who can access shared external storage, such as through an authorized non-root ADB shell or another local file-reading context with suitable storage access, can copy the SQLite database and media files directly without entering the vault passcode.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-19
Last Modified
2026-09-20
Generated
2026-09-20
AI Q&A
2026-09-20
EPSS Evaluated
N/A
NVD
CVE-2026-77875

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
quantumtech_ltd hidden_calculator 4.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-922 The product stores sensitive information without properly limiting read or write access by unauthorized actors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves an application that uses a calculator-style passcode to protect access to stored data. However, the sensitive data is stored in a shared external storage directory that is not encrypted or bound to the authentication mechanism. This allows a local attacker with access to shared storage, such as through an ADB shell, to directly copy and access the SQLite database and media files without entering the vault passcode.

Detection Guidance

Check if the app stores data in the shared external storage directory /storage/emulated/0/.Calculator_dont_delete_me/. Look for files like SQLite databases or media files in this location. Use ADB shell commands such as 'ls /storage/emulated/0/.Calculator_dont_delete_me/' to inspect the directory.

Impact Analysis

An attacker could gain access to sensitive information stored in the app, including images, account names, passwords, PINs, and emails. Since the data is stored in cleartext or easily decodable formats, the attacker can retrieve and decode this information offline without needing the vault passcode.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and privacy, such as GDPR and HIPAA, due to unauthorized access to sensitive personal data. Storing unencrypted sensitive information in shared storage increases the risk of data breaches, which can lead to legal penalties and reputational damage.

Mitigation Strategies

Uninstall the affected app 'Hide Photos - Secure vault' by QUANTUMTECH LTD immediately. Avoid granting broad storage permissions like MANAGE_EXTERNAL_STORAGE to any app. Monitor for unauthorized access to shared storage directories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77875. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart