---
id: "CVE-2026-116106"
kind: "vulnerability"
aliases: ["CVE-2026-116106"]
title: "HeyCyan App on Android: FileProvider flaw allows improper access to files"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["android", "heycyan", "mobile", "package"]
not_affected_if: ["unknown"]
published_at: "2026-10-26T02:17:06+00:00"
first_seen_at: "2026-10-26T02:39:11+00:00"
updated_at: "2026-10-26T02:39:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116106", "first_seen_at": "2026-10-26T02:39:11+00:00"}]
---

# HeyCyan App on Android: FileProvider flaw allows improper access to files

HeyCyan App 1.0.103 for Android has a flaw in its FileProvider component that leads to improper access controls. According to the description, an attacker can reach it remotely, but the sources do not say which files or data are exposed.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed HeyCyan App version on Android; unknown whether `1.0.103` is the only affected build
- unknown for any further command or setting, the sources do not say

## Fix

- unknown: the sources do not name a fixed version or vendor patch, and the vendor did not respond to disclosure

## Timeline

- 2026-10-26T02:39:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116106

## From the sources

A security vulnerability has been detected in HeyCyan App 1.0.103 on Android. Affected by this vulnerability is an unknown functionality of the component FileProvider. The manipulation leads to improper access controls. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_