CVE-2026-21131

LowCVSS 2.1

Published: 12/10/2026(UTC)Translated: 12/10/2026(UTC)NVD NIST

Summary

Incorrect default permission in Samsung Flow before version 4.9.22.4 allows local attackers to launch an arbitrary activity with Samsung Flow privileges on the connected device.

Risk Assessment

Risk of local privilege escalation, allowing an attacker to perform unauthorized actions on the connected device.

Recommendation

Update Samsung Flow to version 4.9.22.4 or later. Restrict local access to trusted users.

Other vulnerabilities in Samsung Flow

See all

CVE-2026-21134Medium
Improper authentication in Samsung Flow prior to version 4.9.22.4 allows adjacent attackers to access sensitive information.
CVE-2026-21133Medium
Path traversal in Samsung Flow prior to version 4.9.22.1 allows local attackers to access clipboard data.

Original NVD description (English source)

Incorrect default permission in Samsung Flow prior to version 4.9.22.4 allows local attackers to launch an arbitrary activity with Samsung Flow privileges on the connected device.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS