Description
A potential improper authorization vulnerability was reported in the Lenovo File Manager Android Application, distributed exclusively in the Chinese market, that could allow a local authenticated user to read or modify protected files within the application.
Published: 2026-09-10
Score: 8.4 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized file access via local privileged user
Action: Immediate Patch
AI Analysis

Impact

The Lenovo File Manager Android Application contains an improper authorization flaw where a local authenticated user can read or modify protected files within the app. This grants an attacker unauthorized access, potentially exposing sensitive data or altering application behavior. The weakness corresponds to CWE‑926.

Affected Systems

The vulnerability affects the Lenovo File Manager Android Application sold in the Chinese market. All releases prior to version 9.8.1.77 are impacted. Updated releases starting with 9.8.1.77 contain the fix.

Risk and Exploitability

With a CVSS score of 8.4, the bug is high severity. The EPSS score is not provided and the issue is not listed in CISA KEV. Because the flaw arises from missing authorization checks (CWE‑926), it can be exploited by any local user who can launch the app; no remote exploitation is reported. An attacker controlling the device or with local privileges can perform read or modify operations on protected files without additional prerequisites.

Generated by OpenCVE AI on September 11, 2026 at 05:10 UTC.

Remediation

Vendor Solution

Update Lenovo File Manager Android APP to Version 9.8.1.77 or later.

OpenCVE Recommended Actions

  • Update the Lenovo File Manager Android App to version 9.8.1.77 or later.
  • If an update cannot be performed, uninstall the application.
  • If the application must remain installed, configure device or OS‑level sandboxing and restrict its file‑system permissions so it cannot access protected files.

Generated by OpenCVE AI on September 11, 2026 at 05:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://iknow.lenovo.com.cn/detail/442247 cve-icon cve-icon
History

Fri, 11 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 11 Sep 2026 05:30:00 +0000

Type Values Removed Values Added
Title Improper Authorization Allowing Local User to Read/Modify Protected Files in Lenovo File Manager Android App

Fri, 11 Sep 2026 02:00:00 +0000

Type Values Removed Values Added
Title Improper Authorization Allowing Local User to Read/Modify Protected Files in Lenovo File Manager Android App

Thu, 10 Sep 2026 21:15:00 +0000

Type Values Removed Values Added
Description A potential improper authorization vulnerability was reported in the Lenovo File Manager Android Application, distributed exclusively in the Chinese market, that could allow a local authenticated user to read or modify protected files within the application.
First Time appeared Lenovo
Lenovo file Manager Application
Weaknesses CWE-926
CPEs cpe:2.3:a:lenovo:file_manager_application:*:*:android:*:*:*:*:*
Vendors & Products Lenovo
Lenovo file Manager Application
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

cvssV4_0

{'score': 8.4, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Lenovo File Manager Application
cve-icon MITRE

Status: PUBLISHED

Assigner: lenovo

Published:

Updated: 2026-09-11T14:47:22.980Z

Reserved: 2026-08-05T19:22:01.860Z

Link: CVE-2026-18994

cve-icon Vulnrichment

Updated: 2026-09-11T14:47:12.374Z

cve-icon NVD

Status : Deferred

Published: 2026-09-10T21:17:24.467

Modified: 2026-09-11T15:17:00.380

Link: CVE-2026-18994

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-11T08:00:13Z

Weaknesses
  • CWE-926

    Improper Export of Android Application Components