Insecure permissions in the CardProvider content provider of helloworld1 AnyMemo (versionCode 20260730) allow an attacker to read all card data stored in the user’s memorization database. This flaw is an instance of improper access control, exposing confidential study material to any component that can query the provider.

The affected product is helloworld1 AnyMemo for Android, specifically versionCode 20260730. No other vendors or products are listed.

No CVSS score is provided, and the EPSS score is unavailable, making the exact exploitation probability unknown. The flaw is listed in neither KEV nor any public exploit database, suggesting no documented widespread exploitation yet. However, the attack vector is likely local or via another malicious application that can access the unsecured content provider, making the risk of data leakage real for users of this version.