CVE-2026-77884: Gallery Photo Vault Information Disclosure

CVE-2026-77884 Overview

CVE-2026-77884 affects Gallery - Private Photo Vault version 1.0.41, an Android application distributed through Google Play. The application starts an unauthenticated HTTP server on TCP port 8080 that is reachable from the local network. The server exposes files and directory listings from Android external storage without any authentication or authorization checks. This exposure maps to [CWE-552] (Files or Directories Accessible to External Parties). Any device on the same Wi-Fi or adjacent network segment can browse and retrieve private photos and videos that the application was designed to protect.

Critical Impact
An adjacent-network attacker can enumerate and download the contents of Android external storage from a vulnerable device without credentials, defeating the vault's core privacy guarantee.

Affected Products

Gallery - Private Photo Vault version 1.0.41 (Android application, package bt.photo.video.lock.album)
Android devices with the affected application installed and connected to a shared network
Any external storage content accessible to the application at runtime

Discovery Timeline

2026-09-14 - CVE-2026-77884 published to the National Vulnerability Database
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-77884

Vulnerability Analysis

Gallery - Private Photo Vault 1.0.41 embeds an HTTP listener bound to 0.0.0.0:8080 while the application is running. The listener requires no authentication and serves both file downloads and directory index pages. Because Android external storage typically contains user photos, videos, downloads, and application data, the exposure extends well beyond the vault's own content. An attacker joining the same wireless network can scan for hosts responding on TCP port 8080 and immediately browse directory listings served by the app. The vulnerability requires no user interaction on the victim device beyond having the application active. The CWE-552 mapping reflects the design flaw: sensitive resources are made accessible to external parties without controls.

Root Cause

The root cause is an insecure default configuration combined with missing authentication on a network-exposed service. The application launches an HTTP server that listens on all network interfaces rather than binding to the loopback address. No session tokens, credentials, or origin checks gate access to the served directory tree. This design contradicts the application's stated purpose of protecting private media.

Attack Vector

Exploitation requires adjacent-network access, such as a shared Wi-Fi network in a home, office, cafe, or hotel. An attacker performs a TCP scan for port 8080 on the local subnet, connects with any HTTP client such as a browser or curl, and requests the root path. The server responds with a directory listing that the attacker can traverse to enumerate and download files from Android external storage. No exploit code is required beyond standard HTTP client tooling. See the Fluid Attacks Security Advisory and Google Play App Details for additional context.

Detection Methods for CVE-2026-77884

Indicators of Compromise

Unexpected TCP listener on port 8080 on Android devices, observable through network scans of the local subnet
HTTP GET requests to / or subdirectory paths returning HTML directory index responses from a mobile device IP
Outbound file transfers from an Android device on port 8080 to peers on the same wireless network

Detection Strategies

Perform authorized network sweeps of managed wireless segments for hosts responding on TCP 8080 with HTML directory listings
Inspect wireless network flow records for east-west HTTP traffic terminating on mobile device IP addresses
Correlate DHCP lease data with port-scan findings to attribute exposed listeners to specific Android devices

Monitoring Recommendations

Enable wireless intrusion detection to flag peer-to-peer HTTP sessions on guest and employee Wi-Fi networks
Alert on any Android endpoint that opens a listening TCP socket on a non-standard port while joined to corporate Wi-Fi
Log and review directory-listing HTTP responses observed on internal networks, which are rarely legitimate for mobile clients

How to Mitigate CVE-2026-77884

Immediate Actions Required

Uninstall Gallery - Private Photo Vault 1.0.41 from managed and personal Android devices until a fixed release is available
Remove sensitive media from Android external storage on devices where the application was installed
Restrict affected devices to trusted networks and disable Wi-Fi on untrusted networks such as public hotspots

Patch Information

No vendor patch is referenced in the CVE record at the time of publication. Monitor the Google Play App Details page and the Fluid Attacks Security Advisory for updated versions and vendor guidance.

Workarounds

Force-stop the application and revoke its storage permissions through Android settings to reduce the exposed surface
Configure wireless networks to enable client isolation, preventing peer-to-peer connections between Wi-Fi clients
Block inbound TCP 8080 at wireless access points where client-to-client traffic cannot be fully isolated

bash

# Example: enable AP client isolation on a supported access point
# (syntax varies by vendor - consult access point documentation)
set wireless.wifi0.isolate=1
set wireless.wifi1.isolate=1
commit wireless