CVE-2026-18591: Meesho App Information Disclosure Flaw

CVE-2026-18591 Overview

CVE-2026-18591 affects the Meesho Online Shopping App for Android up to build 20260607. The flaw resides in an unspecified function within the com.meesho.supply component. Manipulation of the user_id, phone number, email address, or name arguments results in cleartext storage of sensitive information [CWE-310]. Exploitation requires direct access to the physical device, and a public exploit disclosure exists. The vendor was contacted early about this disclosure. The weakness is categorized as insecure data storage on the mobile client rather than a remote network exposure.

Critical Impact
An attacker with physical access to an unlocked Android device can retrieve personally identifiable information (PII) — including phone number, email address, name, and internal user identifier — from local app storage without cryptographic protection.

Affected Products

Meesho Online Shopping App for Android — builds up to and including 20260607
Vulnerable component: com.meesho.supply
Platform: Android

Discovery Timeline

2026-08-03 - CVE-2026-18591 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-18591

Vulnerability Analysis

The Meesho Android application stores user account attributes on the device without encryption. The com.meesho.supply component handles arguments containing user_id, phone number, email address, and name, then persists these values in local storage in cleartext. Anyone with local read access to the app sandbox — for example on a rooted device, through Android Debug Bridge (adb) backup on debug-enabled builds, or on a device already unlocked in an adversary's possession — can recover the PII. The classification falls under [CWE-310] Cryptographic Issues, specifically the absence of at-rest encryption for sensitive fields. Because the attack vector is physical, remote mass exploitation is not feasible. However, the flaw remains relevant in device theft, lost-and-found handling, forensic acquisition, and shared-device scenarios common with commerce apps.

Root Cause

The root cause is the application's decision to write user identifiers and contact data directly to local storage without applying encryption via the Android Keystore, EncryptedSharedPreferences, or an equivalent mechanism. Sensitive fields are treated as ordinary configuration values rather than protected secrets.

Attack Vector

Exploitation requires physical access to the target device. An attacker with shell or file-system access to the com.meesho.supply data directory can read the stored PII directly. The CVSS 4.0 vector confirms a physical attack path with low complexity and low privileges. No user interaction is required beyond obtaining the device.

No verified proof-of-concept code has been published to a recognized exploit database. Public references point to a submission tracked on VulDB and a GitHub CVE request repository; see the GitHub CVE Request and VulDB CVE-2026-18591 entries for the disclosure narrative.

Detection Methods for CVE-2026-18591

Indicators of Compromise

Presence of cleartext user_id, phone number, email, or name strings inside files under /data/data/com.meesho.supply/ on a rooted or forensically imaged device.
Unexpected adb backup or file-manager access targeting the Meesho application data directory.
Third-party file explorer apps requesting broad storage permissions and touching Meesho app data.

Detection Strategies

Perform static inspection of the installed APK and its shared preferences, SQLite databases, and internal files to confirm whether PII fields are stored without encryption.
Use mobile application security testing (MAST) tooling such as MobSF to flag cleartext storage patterns within com.meesho.supply.
In managed device fleets, audit for rooted devices or debug-enabled builds where local app data is accessible to other processes.

Monitoring Recommendations

Monitor mobile device management (MDM) telemetry for jailbreak/root status changes on devices where the Meesho app is installed.
Track application version inventory to identify endpoints still running Meesho builds up to 20260607.
Alert on USB debugging enablement and adb connections on corporate-managed Android devices.

How to Mitigate CVE-2026-18591

Immediate Actions Required

Update the Meesho Online Shopping App to a build newer than 20260607 once the vendor publishes a fix, then confirm the new version through the Google Play Store.
Enforce device-level encryption, a strong lock screen, and biometric unlock on every Android device that uses the app.
Disable USB debugging and revoke adb authorizations on production user devices.
Avoid installing the Meesho app on rooted devices or on devices shared with untrusted users.

Patch Information

At the time of publication, no fixed version has been listed in the NVD entry or the referenced VulDB record. The disclosure notes that the vendor was contacted early. Track the VulDB Vulnerability #385419 page and the official Google Play listing for a patched build superseding 20260607.

Workarounds

Restrict physical access to devices where the Meesho app is installed, and enable remote wipe through the device owner's Google account or MDM.
Sign out of the Meesho app when the device leaves the user's control, and clear app data if the device is decommissioned or resold.
On managed fleets, block installation of the vulnerable com.meesho.supply build range through an application allow-list policy until a patched version is available.

bash

# Application inventory check on an Android endpoint (requires adb and authorized device)
adb shell dumpsys package com.meesho.supply | grep -E "versionName|versionCode"

# On a managed fleet, list devices still running vulnerable Meesho builds
# (adjust the build comparison to your MDM query language)
# Example pseudo-query:
#   package == "com.meesho.supply" AND versionCode <= 20260607