Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get the data of contact and gallery wi

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• samsung accountbefore 13.2.00.6

Versions reported by the vendor

Affected version ranges reported by the assigning authority (Samsung Mobile). Independent of NVD's CPE analysis and usually ahead of it.

• Samsung Mobile Samsung Account

  • unspecified and later · before 13.2.00.6affected

Other highest-scoring records for the same primary product.

• CVE-2021-25381Using unsafe PendingIntent in Samsung Account in versions 10.8.0.4 in Android P(9.0) and below, and 12.1.1.3 in Android Q(10.0) and above al
  31Monitor
• CVE-2023-21481Improper URL input validation vulnerability in Samsung Account application prior to version 14.1.0.0 allows remote attackers to get sensitiv
  30Monitor
• CVE-2022-30735Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get the access_token without permissio
  30Monitor
• CVE-2022-30732Exposure of Sensitive Information vulnerability in Samsung Account prior to version 13.2.00.6 allows attacker to access sensitive informatio
  30Monitor
• CVE-2026-20994URL redirection in Samsung Account prior to version 15.5.01.1 allows local attackers to potentially get access token.
  27Monitor
• CVE-2023-42551Use of implicit intent for sensitive communication vulnerability in startTncActivity in Samsung Account prior to version 14.5.00.7 allows at
  26Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

The extension requests broader permissions than its function needs and sends the data it collects out for purposes beyond its stated function.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1{2  "permissions": ["tabs", "<all_urls>"],3  "background": { "service_worker": "analytics.js" }4}

1{2  "permissions": ["activeTab"],3  "host_permissions": ["https://yildiz.example/*"]4}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.