Meesho Online Shopping App com.meesho.supply cleartext storage
Summary
| CVE | CVE-2026-18591 |
|---|---|
| State | PUBLISHED |
| Assigner | VulDB |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-08-03 08:17:18 UTC |
| Updated | 2026-10-23 22:10:00 UTC |
| Description | A vulnerability was identified in Meesho Online Shopping App up to 20260607 on Android. Affected by this vulnerability is an unknown functionality of the component com.meesho.supply. Such manipulation of the argument user_id/phone number/email address/name leads to cleartext storage of sensitive information. The attack can be executed directly on the physical device. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure. |
Risk And Classification
Primary CVSS: v4.0 0.9 LOW from [email protected]
CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS: 0.001090000 probability, percentile 0.011780000 (date 2026-10-23)
Problem Types: CWE-310 | CWE-312 | CWE-312 Cleartext Storage of Sensitive Information | CWE-310 Cryptographic Issues
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 0.9 | LOW | CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/C... |
| 4.0 | CNA | DECLARED | 2.4 | LOW | CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P |
| 3.1 | [email protected] | Secondary | 2.1 | LOW | CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| 3.1 | CNA | DECLARED | 2.1 | LOW | CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R |
| 3.0 | CNA | DECLARED | 2.1 | LOW | CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R |
| 2.0 | [email protected] | Secondary | 1.7 | AV:L/AC:L/Au:S/C:P/I:N/A:N | |
| 2.0 | CNA | DECLARED | 1.7 | AV:L/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR |
CVSS v4.0 Breakdown
Attack Vector
PhysicalAttack Complexity
LowAttack Requirements
NonePrivileges Required
LowUser Interaction
NoneConfidentiality
LowIntegrity
NoneAvailability
NoneSub Conf.
NoneSub Integrity
NoneSub Availability
NoneCVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 Breakdown
Attack Vector
PhysicalAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
LowIntegrity
NoneAvailability
NoneCVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v3.0 Breakdown
Attack Vector
PhysicalAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
LowIntegrity
NoneAvailability
NoneCVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Meesho | Online Shopping App | affected 20260607 | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| vuldb.com/vuln/385419/cti | [email protected] | vuldb.com | |
| github.com/honestcorrupt/MEESHO-CVE_REQUEST_NEW | [email protected] | github.com | |
| vuldb.com/cve/CVE-2026-18591 | [email protected] | vuldb.com | |
| vuldb.com/submit/850975 | [email protected] | vuldb.com | |
| vuldb.com/vuln/385419 | [email protected] | vuldb.com | |
| drive.google.com/file/d/1tUOME-DfuTVDnbCxvDPKNAZjrRl0GmJQ/view | [email protected] | drive.google.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: honest_corrupt (VulDB User) (en)
CNA: VulDB CNA Team (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-08-02T00:00:00.000Z | Advisory disclosed |
| CNA | 2026-08-02T02:00:00.000Z | VulDB entry created |
| CNA | 2026-08-02T22:49:10.000Z | VulDB entry last update |
There are currently no legacy QID mappings associated with this CVE.