Cleartext Storage Vulnerability in Meesho Online Shopping App on Android
CVE-2026-18591

2.4LOW

Key Information:

Vendor

Meesho

Status
Online Shopping App
Vendor
CVE Published:
3 August 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-18591?

A vulnerability in the Meesho Online Shopping App for Android, specifically in the com.meesho.supply component, allows for the unsafe handling of sensitive user data. This weakness results in the cleartext storage of personal information such as user ID, phone number, email address, and name, which can be exploited directly on a physical device. Given that the exploit methods are publicly available, users of the affected version should take immediate precautions to secure their data.

Affected Version(s)

Online Shopping App 20260607

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-18591 - Proof of Concept

References

https://vuldb.com/vuln/385419
vdb-entrytechnical-description
https://vuldb.com/vuln/385419/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-18591
third-party-advisory

CVSS V4

Score:
2.4
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Physical
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

honest_corrupt (VulDB User)
VulDB CNA Team
.