Improper access control in the CocktailBarService pre‑Oct‑2026 Release 1 allows a local attacker on a Samsung Mobile device to request and retrieve data that should be protected. The vulnerability is a classic access control flaw that grants unauthorized residual read access to sensitive internal information. The impact is that a malicious user with local device access could exfiltrate confidential data the affected service, potentially compromising user privacy and confidentiality.

Samsung Mobile Devices running the CocktailBarService before the Oct‑2026 Release 1 update are affected. No specific model or firmware version is listed, so any device deployed with the older service is considered at risk.

The CVSS score of 5.1 indicates medium severity. Because the vulnerability requires local privilege, the likelihood of exploitation depends on a user’s physical or privileged access to the device. The EPSS score is not available, and the vulnerability is not in the CISA KEV catalog, suggesting no confirmed exploit in the wild as of the data date. Therefore, while the potential impact is significant for sensitive data, actual exploitation risk is moderate but should be mitigated promptly.