The vulnerability arises from insecure permissions on the ContentProvider component in mhss1 MyBrain v3.1.0, allowing an attacker to read any user's private notes, tasks, or diary entries. This results in a direct compromise of confidential personal data without requiring user interaction. The weakness reflects improper access control and information exposure, enabling unauthorized disclosure of sensitive content.

The affected product is mhss1 MyBrain v3.1.0. The CVE description specifically mentions this version; no other versions have been reported as vulnerable. The ContentProvider component of this application is responsible for storing user data and is exposed with insufficient permission restrictions.

No EPSS or CVSS scores are available, and the vulnerability is not listed in CISA KEV. The exploit requires a malicious Android application to access the provider, implying a local or inter‑app attack vector. While the likelihood of exploitation is uncertain without metrics, the potential impact is a loss of privacy for all users of the stated version. Official vendor guidance about mitigation is not provided in the data.