CVE-2026-77884 affects Brain Trust's Gallery - Private Photo Vault version 1.0.41. The application starts an unauthenticated HTTP server reachable from the local network on TCP port 8080. This server serves files and directory listings directly from the Android external storage, exposing potentially sensitive user data without requiring authentication. The vulnerability is categorized under CWE-552, which concerns files or directories accessible to unauthorized external parties. The CVSS 4.0 score is 7.1 (high severity), reflecting the network attack vector with low complexity and no privileges or user interaction required, but with high impact on confidentiality.

An attacker on the local network can access files and directory listings stored on the Android external storage of affected devices without authentication. This exposure could lead to unauthorized disclosure of sensitive or private user data stored in the photo vault application.

No official patch or remediation is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should restrict local network access to affected devices and avoid using the vulnerable version in untrusted network environments.