Vulnerability · Published Oct 26, 2026 · Assigned by VulDB

CVE-2026-116106HeyCyan App FileProvider access control

High 7.3

In plain English

A high-severity improper access control in HeyCyan App. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 29% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.3%top 71.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

A security vulnerability has been detected in HeyCyan App 1.0.103 on Android. Affected by this vulnerability is an unknown functionality of the component FileProvider. The manipulation leads to improper access controls. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
n/a	HeyCyan App	1.0.103

Weakness: CWE-284, CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C

References

VDB-426174 | HeyCyan App FileProvider access control vdb-entry
VDB-426174 | CTI Indicators (IOB, IOC, TTP) signature, permissions-required
CVE-2026-116106 | CVE Analysis and Report third-party-advisory
Submit #1002851 | HeyCyan HeyCyan Android application 1.0.103 Exposure of Access Control List Files to an Unauthorized Control third-party-advisory
https://github.com/ohackercego/heycyan-vulnerabilitys related