An improper authorization flaw in Smart Switch versions prior to 3.7.73 allows a physical attacker to invoke the application restore process without proper privilege checks. By triggering a restore, an attacker could cause the device to re‑import user data, potentially exposing sensitive personal information that was previously backed up. This weakness does not directly lead to code execution but permits unauthorized data recovery, representing a confidentiality breach.

Samsung Mobile Smart Switch, all versions prior to 3.7.73; no specific version list is available in the current advisory.

The vulnerability carries a CVSS score of 6.8, indicating moderate potential impact. Exploitation requires physical proximity to the target device and the ability to interact with the application, which limits the attack surface to local attackers. The EPSS score is not available, and the issue is not listed in CISA KEV, suggesting that no widespread exploitation has been documented. Nevertheless, the authorized bypass could be used by an attacker who physically controls the device to compromise user data.