The vulnerability is an incorrect authorization logic within Samsung Health that allows a local attacker to view personal health information. It is an improper authorization flaw, identified as CWE‑863, which can lead to exposure of confidential data such as medical records or personal metrics. The impact is the loss of confidentiality for users who rely on the app to store or manage private health data.

Samsung Health on Samsung Mobile devices running any version prior to 7.0.0 is affected. The issue is present in all releases before the 7.0.0 update, regardless of device model or Android version, as the authorization check is performed inside the app itself.

The CVSS score of 6.9 indicates a moderate severity, reflecting that the flaw does not allow remote code execution but can subvert data privacy. The EPSS score is reported as less than 1%, indicating a very low likelihood of active exploitation, and the absence of a KEV listing suggests it has not yet been widely exploited. The attack vector is local; an attacker must have physical or device‑access privileges, such as a renter or someone with temporary access to a device. Once local access is achieved, the authorization bypass exposes private health data to the attacker.