CVE-2026-21076 describes an incorrect authorization vulnerability in Samsung Health before version 7.0.0. This vulnerability enables local attackers to bypass access controls and gain access to sensitive information stored or managed by the application. The vulnerability is classified as moderate severity with a CVSS 4.0 vector indicating local attack vector and low complexity. No vendor advisory or patch information is currently available, and no known exploits have been reported in the wild.

Local attackers can access sensitive information within Samsung Health due to improper authorization checks. This could lead to unauthorized disclosure of personal health data. There is no indication of privilege escalation, remote exploitation, or denial of service from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to devices running vulnerable versions and monitor for updates from Samsung regarding this issue.