This vulnerability affects the Meesho Online Shopping App on Android up to version 20260607. An unspecified functionality in the com.meesho.supply component improperly stores sensitive user data (user_id, phone number, email address, name) in cleartext on the device. This cleartext storage could potentially expose sensitive information if an attacker gains physical access to the device. The exploit is publicly available, but there is no indication of widespread exploitation. The vendor was contacted early but has not published a patch or mitigation.

Sensitive user information is stored in cleartext on the device, which could lead to unauthorized disclosure if the device is compromised or accessed by an attacker. However, the attack requires physical access to the device and local privileges, limiting the scope and ease of exploitation. The CVSS score of 2.4 reflects the low severity and limited impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict physical access to their devices and consider removing sensitive data from the app if possible. No vendor-provided mitigation or temporary fix is currently available.