CVE-2026-18591

A vulnerability was identified in Meesho Online Shopping App up to 20260607 on Android. Affected by this vulnerability is an unknown functionality of the component com.meesho.supply. Such manipulation of the argument user_id/phone number/email address/name leads to cleartext storage of sensitive information. The attack can be executed directly on the physical device. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.

CVSS v3 2.1 LOW
CVSS v2.0 1.7 LOW

2.1^/10

CVSS v3 : LOW

Vector :

Exploitability : 0.7 / Impact : 1.4

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

1.7^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 3.1 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://drive.google.com/file/d/1tUOME-DfuTVDnbCxvDPKNAZjrRl0GmJQ/view
https://github.com/honestcorrupt/MEESHO-CVE_REQUEST_NEW
https://vuldb.com/cve/CVE-2026-18591
https://vuldb.com/submit/850975
https://vuldb.com/vuln/385419
https://vuldb.com/vuln/385419/cti

Configurations

No configuration.

History

23 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Se identificó una vulnerabilidad en la aplicación Meesho Online Shopping App hasta la versión 20260607 en Android. Esta vulnerabilidad afecta a una funcionalidad desconocida del componente com.meesho.supply. Dicha manipulación del argumento user_id/número de teléfono/dirección de correo electrónico/nombre conduce al almacenamiento en texto plano de información sensible. El ataque puede ejecutarse directamente en el dispositivo físico. El exploit está disponible públicamente y podría ser utilizado. Se contactó al proveedor con antelación sobre esta divulgación.

Information

Published : 2026-08-03 08:17

Updated : 2026-10-23 22:10

NVD link : CVE-2026-18591

Mitre link : CVE-2026-18591

CVE.ORG link : CVE-2026-18591

JSON object : View

Products Affected

No product.

CWE

CWE-310

Cryptographic Issues

CWE-312

Cleartext Storage of Sensitive Information

{"id": "CVE-2026-18591", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18591", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-03T13:18:52.927130Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 1.7, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.1, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.1, "attackVector": "PHYSICAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 0.7}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 0.9, "Automatable": "NOT_DEFINED", "attackVector": "PHYSICAL", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@vuldb.com", "affectedData": [{"cpes": ["cpe:2.3:a:meesho:online_shopping_app:*:*:*:*:*:*:*:*"], "vendor": "Meesho", "modules": ["com.meesho.supply"], "product": "Online Shopping App", "versions": [{"status": "affected", "version": "20260607"}]}]}], "published": "2026-08-03T08:17:18.823", "references": [{"url": "https://drive.google.com/file/d/1tUOME-DfuTVDnbCxvDPKNAZjrRl0GmJQ/view", "source": "cna@vuldb.com"}, {"url": "https://github.com/honestcorrupt/MEESHO-CVE_REQUEST_NEW", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/cve/CVE-2026-18591", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/submit/850975", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/385419", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/385419/cti", "source": "cna@vuldb.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-310"}, {"lang": "en", "value": "CWE-312"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in Meesho Online Shopping App up to 20260607 on Android. Affected by this vulnerability is an unknown functionality of the component com.meesho.supply. Such manipulation of the argument user_id/phone number/email address/name leads to cleartext storage of sensitive information. The attack can be executed directly on the physical device. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure."}, {"lang": "es", "value": "Se identific\u00f3 una vulnerabilidad en la aplicaci\u00f3n Meesho Online Shopping App hasta la versi\u00f3n 20260607 en Android. Esta vulnerabilidad afecta a una funcionalidad desconocida del componente com.meesho.supply. Dicha manipulaci\u00f3n del argumento user_id/n\u00famero de tel\u00e9fono/direcci\u00f3n de correo electr\u00f3nico/nombre conduce al almacenamiento en texto plano de informaci\u00f3n sensible. El ataque puede ejecutarse directamente en el dispositivo f\u00edsico. El exploit est\u00e1 disponible p\u00fablicamente y podr\u00eda ser utilizado. Se contact\u00f3 al proveedor con antelaci\u00f3n sobre esta divulgaci\u00f3n."}], "lastModified": "2026-10-23T22:10:00.160", "sourceIdentifier": "cna@vuldb.com"}