CVE-2026-49189: Broadcast Receiver Privilege Escalation
Unchecked public access permissions on a core Broadcast Receiver allow unauthorized local software components to invoke administrative operations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable public/exported access on the Broadcast Receiver or enforce an explicit permission check so only authorized callers can invoke its administrative operations. Ensure the receiver verifies caller identity/permissions before performing admin actions.
core Broadcast Receiver public_access/exported = disabled or require explicit permission - Compensating control
Restrict which local software can interact with the Broadcast Receiver (for example via OS-level policy, application sandboxing, SELinux rules, or similar platform controls). Whitelist only trusted/privileged components and block untrusted apps from sending broadcasts to the receiver.
- Operational
Audit logs and application behavior for any past unauthorized invocations of the Broadcast Receiver; identify and remove or remediate any untrusted apps that invoked administrative operations and revoke any privileges granted as a result.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49189?
The severity of CVE-2026-49189 is rated as high with a CVSS score of 8.5.
What type of vulnerability is CVE-2026-49189?
CVE-2026-49189 is a Broadcast Receiver Privilege Escalation vulnerability.
How do I fix CVE-2026-49189?
To fix CVE-2026-49189, ensure that all public access permissions on the core Broadcast Receiver are properly restricted.
What risks are associated with CVE-2026-49189?
CVE-2026-49189 allows unauthorized local software components to invoke administrative operations, potentially compromising system security.
On which software is CVE-2026-49189 found?
CVE-2026-49189 is associated with the Acer Connect M6e 5g Firmware.