CVE-2026-18591 describes a vulnerability in the Meesho Online Shopping App on Android versions up to 20260607. The flaw involves improper handling of user-related input parameters such as user_id, phone number, email address, or name, which leads to sensitive information being stored in cleartext. This vulnerability resides in an unspecified functionality of the com.meesho.supply component. Exploitation requires local access to the device, and no remote attack vector is indicated. The vulnerability has a CVSS 3.1 base score of 2.1, reflecting low impact primarily on confidentiality. The vendor was notified early, but no patch or remediation details are provided in the available data.

The vulnerability results in the cleartext storage of sensitive user information on the device, which could lead to unauthorized disclosure if an attacker gains physical access. There is no indication of impact on integrity or availability. The attack requires local access and low privileges, with no user interaction needed. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch information is provided, users should avoid exposing their devices to untrusted parties and monitor vendor communications for updates. No specific mitigation steps are indicated by the vendor at this time.