A local attacker can read arbitrary files on a device running Samsung Cloud prior to version 5.6.11 because the software fails to enforce sufficient permissions, allowing the attacker to invoke operations that bypass normal access controls.

The vulnerability affects Samsung Cloud, part of the Samsung Mobile ecosystem, for all releases earlier than 5.6.11. Any device running an affected version could be compromised, exposing confidential files stored within the cloud service.

With a CVSS score of 2.1, the technical severity is low. The EPSS score is less than 1 %, indicating a very small probability that an attack would be executed in the wild, and the issue is not listed in the CISA KEV catalog. The likely attack vector is local: an attacker with access to the device can target the cloud service without remote network involvement.