CVE-2025-20926 Missing authorization in Samsung My Files
Local attackers can access files with elevated privileges due to improper component export in the Samsung My Files application.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-20926?
CVE-2025-20926 is a medium-severity missing authorization vulnerability in Samsung My Files, published on 6 Mar 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Improper export of Android application components in My Files prior to version 15.0.07.5 in Android 14 allows local attackers to access files with My Files' privilege.
Which versions are affected by CVE-2025-20926?
It affects 1 product.
Products include Samsung Myfiles.
How do I fix CVE-2025-20926?
No fix has been published for CVE-2025-20926 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-20926 being exploited?
There is no known exploitation of CVE-2025-20926 in the wild and no public exploit code.
Other vulnerabilities in Samsung My Files
Sources
Also known as GHSA-8m69-67p7-65wf.