CVE-2026-77875: Hide Photos - Secure vault 4.1.0 - Insecure storage of vault media and wallet records in shared external storage
The application protects access through its calculator-style vault passcode, but the stored data is not bound to that authentication boundary. A local actor who can access shared external storage, such as through an authorized non-root ADB shell or another local file-reading context with suitable storage access, can copy the SQLite database and media files directly without entering the vault passcode.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Devices are exposed when a local actor can read shared external storage. The description specifically includes authorized non-root ADB access and other local file-reading contexts with suitable storage permissions.
Does an attacker need the vault passcode or elevated device privileges?
No vault passcode is required because the database and media can be copied directly from shared external storage. The described ADB scenario does not require root, but the attacker must have a local context that can access the storage.
What data can be recovered through this issue?
An actor with the required storage access can copy the SQLite database, media files, and wallet records stored in shared external storage.
How can I determine whether I am affected?
Check whether the application stores its SQLite database and vault media in shared external storage where they can be read outside the application's calculator-style passcode boundary. If those files can be copied through an authorized non-root ADB shell or another permitted local file-reading context, the issue is present.