This vulnerability (CVE-2026-49301) in Huawei HarmonyOS arises from insufficient permission controls in the Gallery module, classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). Exploiting this flaw could allow unauthorized actors to access sensitive data, compromising service confidentiality. The CVSS 3.1 vector indicates the attack requires local access with low complexity and no privileges or user interaction, affecting confidentiality with no impact on integrity or availability. The affected versions explicitly include 4.0.0, 4.2.0, 4.3.0, and 4.3.1. No vendor advisory or patch information is currently available, and no known exploits have been reported.

The vulnerability can lead to unauthorized disclosure of sensitive information within the affected HarmonyOS Gallery module, impacting confidentiality. There is no reported impact on integrity or availability. Exploitation requires local access but no privileges or user interaction, which limits the attack surface somewhat. No known active exploitation has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit local access to affected devices and monitor for updates from Huawei regarding patches or mitigations. No vendor advisory indicates that the issue is already mitigated or requires no action.