The vulnerability identified as CVE-2026-94204 involves incorrect permission assignment (CWE-732) on the central cloud storage backend used by the Viidure Dashcam Android Application platform. The storage bucket is configured with public-read permissions, allowing anyone on the internet to access all stored objects without authentication. This misconfiguration exposes sensitive data such as user records, live dashcam footage, application packages, and firmware files. The issue affects versions from 0 through 3.3.1.260403. The CVSS 4.0 base score is 8.7, indicating high severity, with attack vector network, no privileges required, no user interaction, and high confidentiality impact.

The misconfigured public-read permissions on the cloud storage bucket allow unrestricted access to sensitive data including user records, live dashcam footage, application packages, and firmware files. This exposure can lead to privacy violations and potential unauthorized use or distribution of sensitive information. There is no indication of integrity or availability impact. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a misconfiguration issue, remediation likely involves correcting the permission settings on the cloud storage backend to restrict access appropriately. Until an official fix or guidance is provided by Viidure, users and administrators should verify and restrict storage permissions to prevent public access.