CVE-2026-18591

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-18591", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-08-02T20:44:04.393Z", "datePublished": "2026-08-03T07:15:08.213Z", "dateUpdated": "2026-08-03T13:19:02.255Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-08-03T07:15:08.213Z"}, "title": "Meesho Online Shopping App com.meesho.supply cleartext storage", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-312", "lang": "en", "description": "Cleartext Storage of Sensitive Information"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-310", "lang": "en", "description": "Cryptographic Issues"}]}], "affected": [{"vendor": "Meesho", "product": "Online Shopping App", "versions": [{"version": "20260607", "status": "affected"}], "cpes": ["cpe:2.3:a:meesho:online_shopping_app:*:*:*:*:*:*:*:*"], "modules": ["com.meesho.supply"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in Meesho Online Shopping App up to 20260607 on Android. Affected by this vulnerability is an unknown functionality of the component com.meesho.supply. Such manipulation of the argument user_id/phone number/email address/name leads to cleartext storage of sensitive information. The attack can be executed directly on the physical device. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.4, "vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "LOW"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 2.1, "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 2.1, "vectorString": "CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 1.7, "vectorString": "AV:L/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-08-02T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-08-02T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-08-02T22:49:10.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "honest_corrupt (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/385419", "name": "VDB-385419 | Meesho Online Shopping App com.meesho.supply cleartext storage", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/385419/cti", "name": "VDB-385419 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-18591", "name": "CVE-2026-18591 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/850975", "name": "Submit #850975 | Meesho Meesho Android App Latest (com.meesho.supply) CWE-312 Cleartext Storage of Sensitive Information", "tags": ["third-party-advisory"]}, {"url": "https://github.com/honestcorrupt/MEESHO-CVE_REQUEST_NEW", "tags": ["related"]}, {"url": "https://drive.google.com/file/d/1tUOME-DfuTVDnbCxvDPKNAZjrRl0GmJQ/view", "tags": ["exploit"]}], "x_generator": ["VulDB PVTS v202608"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-03T13:18:52.927130Z", "id": "CVE-2026-18591", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-03T13:19:02.255Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-18591", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-03T13:18:52.927130Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-03T13:18:58.231Z"}}], "cna": {"title": "Meesho Online Shopping App com.meesho.supply cleartext storage", "credits": [{"lang": "en", "type": "reporter", "value": "honest_corrupt (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.4, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 2.1, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 2.1, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 1.7, "vectorString": "AV:L/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:meesho:online_shopping_app:*:*:*:*:*:*:*:*"], "vendor": "Meesho", "modules": ["com.meesho.supply"], "product": "Online Shopping App", "versions": [{"status": "affected", "version": "20260607"}]}], "timeline": [{"lang": "en", "time": "2026-08-02T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-08-02T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-08-02T22:49:10.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/385419", "name": "VDB-385419 | Meesho Online Shopping App com.meesho.supply cleartext storage", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/385419/cti", "name": "VDB-385419 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-18591", "name": "CVE-2026-18591 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/850975", "name": "Submit #850975 | Meesho Meesho Android App Latest (com.meesho.supply) CWE-312 Cleartext Storage of Sensitive Information", "tags": ["third-party-advisory"]}, {"url": "https://github.com/honestcorrupt/MEESHO-CVE_REQUEST_NEW", "tags": ["related"]}, {"url": "https://drive.google.com/file/d/1tUOME-DfuTVDnbCxvDPKNAZjrRl0GmJQ/view", "tags": ["exploit"]}], "x_generator": ["VulDB PVTS v202608"], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in Meesho Online Shopping App up to 20260607 on Android. Affected by this vulnerability is an unknown functionality of the component com.meesho.supply. Such manipulation of the argument user_id/phone number/email address/name leads to cleartext storage of sensitive information. The attack can be executed directly on the physical device. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-312", "description": "Cleartext Storage of Sensitive Information"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-310", "description": "Cryptographic Issues"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-08-03T07:15:08.213Z"}}}, "cveMetadata": {"cveId": "CVE-2026-18591", "state": "PUBLISHED", "dateUpdated": "2026-08-03T13:19:02.255Z", "dateReserved": "2026-08-02T20:44:04.393Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-08-03T07:15:08.213Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:meesho:online_shopping_app:*:*:*:*:*:*:*:*"], "modules": ["com.meesho.supply"], "product": "Online Shopping App", "vendor": "Meesho", "versions": [{"status": "affected", "version": "20260607"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in Meesho Online Shopping App up to 20260607 on Android. Affected by this vulnerability is an unknown functionality of the component com.meesho.supply. Such manipulation of the argument user_id/phone number/email address/name leads to cleartext storage of sensitive information. The attack can be executed directly on the physical device. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure."}, {"lang": "es", "value": "Se identific\u00f3 una vulnerabilidad en la aplicaci\u00f3n Meesho Online Shopping App hasta la versi\u00f3n 20260607 en Android. Esta vulnerabilidad afecta a una funcionalidad desconocida del componente com.meesho.supply. Dicha manipulaci\u00f3n del argumento user_id/n\u00famero de tel\u00e9fono/direcci\u00f3n de correo electr\u00f3nico/nombre conduce al almacenamiento en texto plano de informaci\u00f3n sensible. El ataque puede ejecutarse directamente en el dispositivo f\u00edsico. El exploit est\u00e1 disponible p\u00fablicamente y podr\u00eda ser utilizado. Se contact\u00f3 al proveedor con antelaci\u00f3n sobre esta divulgaci\u00f3n."}], "id": "CVE-2026-18591", "lastModified": "2026-10-23T22:10:00.160", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 1.7, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.1, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 0.7, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "PHYSICAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 0.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18591", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-03T13:18:52.927130Z", "version": "2.0.3"}}]}, "published": "2026-08-03T08:17:18.823", "references": [{"source": "cna@vuldb.com", "url": "https://drive.google.com/file/d/1tUOME-DfuTVDnbCxvDPKNAZjrRl0GmJQ/view"}, {"source": "cna@vuldb.com", "url": "https://github.com/honestcorrupt/MEESHO-CVE_REQUEST_NEW"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-18591"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/850975"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/385419"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/385419/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-310"}, {"lang": "en", "value": "CWE-312"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "20260607"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Online Shopping App", "source": "cna", "vendor": "Meesho"}, "product": "online_shopping_app", "vendor": "meesho"}], "created": "2026-08-03T09:30:17.608190+00:00", "updated": "2026-08-04T21:45:04.737819+00:00", "vendors": ["meesho", "meesho$PRODUCT$online_shopping_app"]}