This vulnerability (CVE-2026-21056) in Samsung Health involves improper authorization (CWE-285) that permits local attackers with low privileges to access information about connected devices. The issue affects versions prior to 7.00.0.107, although the exact affected versions are not explicitly stated in the input data. The CVSS 4.0 vector indicates low attack complexity and requires local access with no user interaction. No vendor advisory or patch information is currently available.

Local attackers with limited privileges can access connected device information that should be protected by proper authorization controls. This may lead to unauthorized disclosure of device data. The impact is limited by the requirement for local access and the absence of privilege escalation or remote exploitation vectors.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to trusted users and monitor for unauthorized local activity related to Samsung Health. Avoid installing untrusted applications or granting unnecessary permissions that could facilitate local exploitation.