---
id: "CVE-2026-59003"
kind: "vulnerability"
aliases: ["CVE-2026-59003"]
title: "Android: missing permission check in subscription manager leaks local information"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["android", "mobile", "runtime", "telephony"]
not_affected_if: ["patched-android-build"]
published_at: "2026-11-02T20:17:55+00:00"
first_seen_at: "2026-11-02T20:35:36+00:00"
updated_at: "2026-11-02T20:37:04+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59003", "first_seen_at": "2026-11-02T20:35:36+00:00"}]
---

# Android: missing permission check in subscription manager leaks local information

A missing permission check in the Android SubscriptionManagerService getSubscriptionProperty method lets an app on the same device read subscription information it should not see. The sources describe local information disclosure only, with no extra execution privileges and no user interaction needed.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-02T20:35:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-59003

## From the sources

In getSubscriptionProperty of SubscriptionManagerService.java, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_