CVE-2026-18994

View on CVE.org
Published Sep 10, 2026 CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Description
A potential improper authorization vulnerability was reported in the Lenovo File Manager Android Application, distributed exclusively in the Chinese market, that could allow a local authenticated user to read or modify protected files within the application.

Analysis

AI-generated

Technical impact

The Lenovo File Manager Android Application contains an improper authorization flaw where a local authenticated user can read or modify protected files within the app. This grants an attacker unauthorized access, potentially exposing sensitive data or altering application behavior. The weakness corresponds to CWE‑926.

Affected Systems

The vulnerability affects the Lenovo File Manager Android Application sold in the Chinese market. All releases prior to version 9.8.1.77 are impacted. Updated releases starting with 9.8.1.77 contain the fix.

Risk and Exploitability

With a CVSS score of 8.4, the bug is high severity. The EPSS score is not provided and the issue is not listed in CISA KEV. Because the flaw arises from missing authorization checks (CWE‑926), it can be exploited by any local user who can launch the app; no remote exploitation is reported. An attacker controlling the device or with local privileges can perform read or modify operations on protected files without additional prerequisites.

Remediation

Vendor Solution

Update Lenovo File Manager Android APP to Version 9.8.1.77 or later.

OpenCVE Recommended Actions

  • Update the Lenovo File Manager Android App to version 9.8.1.77 or later.
  • If an update cannot be performed, uninstall the application.
  • If the application must remain installed, configure device or OS‑level sandboxing and restrict its file‑system permissions so it cannot access protected files.

Generated by OpenCVE AI on September 11, 2026 at 05:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
References
Link Providers
https://iknow.lenovo.com.cn/detail/442247 cve-icon cve-icon
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Title Improper Authorization Allowing Local User to Read/Modify Protected Files in Lenovo File Manager Android App
Type Values Removed Values Added
Title Improper Authorization Allowing Local User to Read/Modify Protected Files in Lenovo File Manager Android App
Type Values Removed Values Added
Description A potential improper authorization vulnerability was reported in the Lenovo File Manager Android Application, distributed exclusively in the Chinese market, that could allow a local authenticated user to read or modify protected files within the application.
First Time appeared Lenovo
Lenovo file Manager Application
Weaknesses CWE-926
CPEs cpe:2.3:a:lenovo:file_manager_application:*:*:android:*:*:*:*:*
Vendors & Products Lenovo
Lenovo file Manager Application
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

cvssV4_0

{'score': 8.4, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}
Weaknesses
  • CWE-926

    Improper Export of Android Application Components

Sources

Status
PUBLISHED
Assigner
lenovo
Published
Updated
Sep 11, 2026, 2:47 PM
Reserved
Aug 5, 2026, 7:22 PM

View source JSON

Updated
Sep 11, 2026, 2:47 PM

JSON

Status
Deferred
Published
Sep 10, 2026, 9:17 PM
Modified
Sep 11, 2026, 3:17 PM

View source JSON

No data.

Updated
Sep 11, 2026, 8:00 AM

JSON