This vulnerability (CVE-2026-21077) involves incorrect authorization in Samsung Health before version 7.0.0. It permits local attackers to bypass authorization controls and access sensitive information stored or managed by the application. The CVSS 4.0 vector indicates local attack vector with low complexity and no privileges or user interaction required, but with high impact on confidentiality. The vendor has not published any official fix or remediation details as of the publication date.

Local attackers can gain unauthorized access to sensitive information within Samsung Health on affected versions prior to 7.0.0. This could lead to privacy breaches or exposure of personal health data. There is no indication of remote exploitation or impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit local access to affected devices and monitor for suspicious activity related to Samsung Health data access.