A vulnerability exists in HeyCyan App 1.0.103 on Android where an unknown functionality within the FileProvider component can be manipulated to bypass proper access controls. This flaw allows an attacker to read or write files that should be protected, potentially exposing confidential data or modifying application state. The weakness aligns with CWE-266 and CWE-284, demonstrating an improper authorization mechanism that could compromise both confidentiality and integrity.

HeyCyan App 1.0.103 for Android is affected. No other versions or editions are listed. The vulnerability is tied to the FileProvider component of this application.

The CVSS score of 6.9 indicates moderate severity. The lack of an approved patch and the vendor’s silence raise concerns. Exploitation could occur remotely, possibly via crafted content-provider URLs or other external inputs. While the EPSS score is unavailable, the absence of a KEV listing does not reduce the risk, as no public exploitation has been confirmed. Organizations using this version should treat the risk as notable and proceed with remediation or monitoring.