CVE-2026-4218

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4218", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-03-15T15:18:12.388Z", "datePublished": "2026-03-16T05:32:07.692Z", "dateUpdated": "2026-03-16T15:28:24.287Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-16T05:32:07.692Z"}, "title": "myAEDES App aedes.me.beta EngageBayUtils.java information disclosure", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-200", "lang": "en", "description": "Information Disclosure"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-284", "lang": "en", "description": "Improper Access Controls"}]}], "affected": [{"vendor": "n/a", "product": "myAEDES App", "versions": [{"version": "1.18.0", "status": "affected"}, {"version": "1.18.1", "status": "affected"}, {"version": "1.18.2", "status": "affected"}, {"version": "1.18.3", "status": "affected"}, {"version": "1.18.4", "status": "affected"}], "modules": ["aedes.me.beta"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in myAEDES App up to 1.18.4 on Android. Affected is an unknown function of the file aedes/me/beta/utils/EngageBayUtils.java of the component aedes.me.beta. Performing a manipulation of the argument AUTH_KEY results in information disclosure. The attack is only possible with local access. The attack's complexity is rated as high. The exploitability is told to be difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2, "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "LOW"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 2.5, "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 2.5, "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 1, "vectorString": "AV:L/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-03-15T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-03-15T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-03-15T16:24:19.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "fxizenta (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/?id.351142", "name": "VDB-351142 | myAEDES App aedes.me.beta EngageBayUtils.java information disclosure", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.351142", "name": "VDB-351142 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.770509", "name": "Submit #770509 | myAEDES myAEDES(aedes.me.beta) 1.18.4 Authorization Credential Exposure", "tags": ["third-party-advisory"]}, {"url": "https://www.notion.so/Authorization-Credential-Exposure-Leading-to-Data-Leakage-in-aedes-me-beta-app-3172de3f97fb8018abc9c25a878f5845?source=copy_link", "tags": ["exploit"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-16T15:28:16.486537Z", "id": "CVE-2026-4218", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T15:28:24.287Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-4218", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-16T15:28:16.486537Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T15:28:20.149Z"}}], "cna": {"title": "myAEDES App aedes.me.beta EngageBayUtils.java information disclosure", "credits": [{"lang": "en", "type": "reporter", "value": "fxizenta (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 2.5, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 2.5, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 1, "vectorString": "AV:L/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "n/a", "modules": ["aedes.me.beta"], "product": "myAEDES App", "versions": [{"status": "affected", "version": "1.18.0"}, {"status": "affected", "version": "1.18.1"}, {"status": "affected", "version": "1.18.2"}, {"status": "affected", "version": "1.18.3"}, {"status": "affected", "version": "1.18.4"}]}], "timeline": [{"lang": "en", "time": "2026-03-15T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-03-15T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-03-15T16:24:19.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.351142", "name": "VDB-351142 | myAEDES App aedes.me.beta EngageBayUtils.java information disclosure", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.351142", "name": "VDB-351142 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.770509", "name": "Submit #770509 | myAEDES myAEDES(aedes.me.beta) 1.18.4 Authorization Credential Exposure", "tags": ["third-party-advisory"]}, {"url": "https://www.notion.so/Authorization-Credential-Exposure-Leading-to-Data-Leakage-in-aedes-me-beta-app-3172de3f97fb8018abc9c25a878f5845?source=copy_link", "tags": ["exploit"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in myAEDES App up to 1.18.4 on Android. Affected is an unknown function of the file aedes/me/beta/utils/EngageBayUtils.java of the component aedes.me.beta. Performing a manipulation of the argument AUTH_KEY results in information disclosure. The attack is only possible with local access. The attack's complexity is rated as high. The exploitability is told to be difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "Information Disclosure"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "Improper Access Controls"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-16T05:32:07.692Z"}}}, "cveMetadata": {"cveId": "CVE-2026-4218", "state": "PUBLISHED", "dateUpdated": "2026-03-16T15:28:24.287Z", "dateReserved": "2026-03-15T15:18:12.388Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-03-16T05:32:07.692Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["aedes.me.beta"], "product": "myAEDES App", "vendor": "n/a", "versions": [{"status": "affected", "version": "1.18.0"}, {"status": "affected", "version": "1.18.1"}, {"status": "affected", "version": "1.18.2"}, {"status": "affected", "version": "1.18.3"}, {"status": "affected", "version": "1.18.4"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in myAEDES App up to 1.18.4 on Android. Affected is an unknown function of the file aedes/me/beta/utils/EngageBayUtils.java of the component aedes.me.beta. Performing a manipulation of the argument AUTH_KEY results in information disclosure. The attack is only possible with local access. The attack's complexity is rated as high. The exploitability is told to be difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Una vulnerabilidad fue detectada en la aplicaci\u00f3n myAEDES hasta la versi\u00f3n 1.18.4 en Android. Afecta a una funci\u00f3n desconocida del archivo aedes/me/beta/utils/EngageBayUtils.java del componente aedes.me.beta. Realizar una manipulaci\u00f3n del argumento AUTH_KEY resulta en revelaci\u00f3n de informaci\u00f3n. El ataque solo es posible con acceso local. La complejidad del ataque se califica como alta. La explotabilidad se dice que es dif\u00edcil. El exploit ahora es p\u00fablico y puede ser usado. El proveedor fue contactado tempranamente sobre esta revelaci\u00f3n, pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-4218", "lastModified": "2026-06-17T10:56:14.520", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "HIGH", "accessVector": "LOCAL", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 1.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:H/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 1.5, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 2.5, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4218", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-16T15:28:16.486537Z", "version": "2.0.3"}}]}, "published": "2026-03-16T14:20:09.263", "references": [{"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.351142"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.351142"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.770509"}, {"source": "cna@vuldb.com", "url": "https://www.notion.so/Authorization-Credential-Exposure-Leading-to-Data-Leakage-in-aedes-me-beta-app-3172de3f97fb8018abc9c25a878f5845?source=copy_link"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-284"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.18.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.18.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.18.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.18.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.18.4"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "myAEDES App", "source": "cna", "vendor": "n/a"}, "product": "myaedes_app", "vendor": "myaedes"}], "analysis": {"en": {"generated_at": "2026-03-17T11:43:06.894150+00:00", "value": {"mitigation_remediation": ["Update the myAEDES App to a version newer than 1.18.4 when a vendor patch is released", "Apply any vendor\u2011issued security fix immediately upon availability", "Restrict local access to the aedes.me.beta component by enabling only authenticated users or by applying local network segmentation", "Monitor official advisories and response from the vendor for further updates"], "summary": {"action": "Immediate Patch", "impact": "Information Disclosure"}, "threat_synthesis": {"affected_systems": "The affected product is myAEDES App with all releases up to version 1.18.4 on Android devices. No specific vendor sub\u2011versions are listed; the vulnerability is reported in the generic \"myAEDES App\" product family.", "description_and_impact": "A vulnerability exists in the myAEDES App, specifically within the file aedes/me/beta/utils/EngageBayUtils.java of the component aedes.me.beta. By manipulating the argument AUTH_KEY, an attacker can read sensitive data that should not be exposed. This results in information disclosure with potential integrity impact on data confidentiality. The weakness corresponds to CWE-200 (Information Exposure) and CWE-284 (Improper Access Control). The exploit is categorized as high complexity and difficult to execute, but the attack surface is limited to local system access only.", "risk_and_exploitability": "The CVSS score is 2, indicating low overall severity, and the EPSS score is below 1%, suggesting a very low probability of exploitation in the wild. The vulnerability is not in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires local access, high attack complexity, and privileged execution, making it unlikely that an attacker can leverage it remotely or in the absence of local host compromise."}}}}, "created": "2026-03-17T09:54:59.859340+00:00", "updated": "2026-03-24T10:45:47.747838+00:00", "vendors": ["myaedes", "myaedes$PRODUCT$myaedes_app"]}