{"id":"CVE-2026-116106","kind":"vulnerability","aliases":["CVE-2026-116106"],"related":[],"title":"HeyCyan App on Android: FileProvider flaw allows improper access to files","description":"A security vulnerability has been detected in HeyCyan App 1.0.103 on Android. Affected by this vulnerability is an unknown functionality of the component FileProvider. The manipulation leads to improper access controls. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"HeyCyan App 1.0.103 for Android has a flaw in its FileProvider component that leads to improper access controls. According to the description, an attacker can reach it remotely, but the sources do not say which files or data are exposed.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","heycyan","mobile","package"],"not_affected_if":["unknown"],"how_to_check":"- Check the installed HeyCyan App version on Android; unknown whether `1.0.103` is the only affected build\n- unknown for any further command or setting, the sources do not say","fix":"- unknown: the sources do not name a fixed version or vendor patch, and the vendor did not respond to disclosure","status":"open","published_at":"2026-10-26T02:17:06+00:00","first_seen_at":"2026-10-26T02:39:11+00:00","triaged_at":"2026-10-26T02:39:35+00:00","updated_at":"2026-10-26T02:39:35+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-26T02:39:35Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources do not name a fixed version or vendor patch, and the vendor did not respond to disclosure","reach":"internet","title":"HeyCyan App on Android: FileProvider flaw allows improper access to files","impact":"medium","summary":"HeyCyan App 1.0.103 for Android has a flaw in its FileProvider component that leads to improper access controls. According to the description, an attacker can reach it remotely, but the sources do not say which files or data are exposed.","category":"package","nicknames":[],"who_cares":["android","mobile","heycyan"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown extent of improper file access from a remote attacker","analyst_note":"Check the NVD entry and any vendor or VulDB advisory for the exact FileProvider exposure, affected version range and whether a fixed build exists.","how_to_check":"- Check the installed HeyCyan App version on Android; unknown whether `1.0.103` is the only affected build\n- unknown for any further command or setting, the sources do not say","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Users of the HeyCyan Android app at version 1.0.103 are the affected population per the description. The sources do not say what data the app's FileProvider exposes or what network conditions enable remote access, so unknown whether a team's own systems are involved.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000588,"input_tokens":3315,"output_tokens":512,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116106':14A,17A '-2026':13A,16A '1.0.103':24B,71C 'access':9A,38B,91C 'accord':40B 'affect':74C 'allow':7A 'android':4A,18B,26B,73C 'app':2A,23B,70C 'attack':45B,94C 'compon':33B,84C 'contact':102C 'control':39B,92C 'cve':12A,15A 'data':59B 'descript':43B 'detect':67C 'disclosur':106C 'earli':103C 'expos':61B 'file':11A,57B 'fileprovid':5A,32B,85C 'flaw':6A,29B 'function':81C 'heycyan':1A,19B,22B,69C 'improp':8A,37B,90C 'initi':97C 'lead':35B,88C 'manipul':87C 'may':95C 'mobil':20B 'packag':21B 'reach':47B 'remot':49B,98C 'respond':110C 'say':55B 'secur':63C 'sourc':52B 'unknown':80C 'vendor':100C 'vulner':64C,77C 'way':113C","nicknames":[],"mitigations":[],"who_affected":"Users of the HeyCyan Android app at version 1.0.103 are the affected population per the description. The sources do not say what data the app's FileProvider exposes or what network conditions enable remote access, so unknown whether a team's own systems are involved.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T02:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116106","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116106","severity":null,"published_at":"2026-10-26T02:17:06+00:00","modified_at":"2026-10-26T02:17:06+00:00","first_seen_at":"2026-10-26T02:39:11+00:00","fetched_at":"2026-10-26T02:39:11+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}