# CVE-2026-15366: vivo Kids Mode access control defect in photo viewer

Source: https://junglewise.ai/threats/cve-2026-15366-vivo-kids-mode-access-control-defect-in-photo-viewer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-15366 · Severity: info · CVSS 3.5 · Published 2026-08-26

vivo Kids Mode is a parental control feature that restricts what children can access on their devices. A logic defect in the photo gallery component allows users to bypass these controls and view local photos that should be restricted, potentially exposing users to unintended content.

Vendors: [Vivo](https://junglewise.ai/threats/vendors/vivo).

## Quick answers

**Is CVE-2026-15366 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15366 being exploited in the wild.

**How severe is CVE-2026-15366?** Informational severity, with a CVSS score of 3.5, published 26 August 2026.

**Which products and versions are affected?** Vivo Kids Mode below 4.9.7.0.

**Is there a fix for CVE-2026-15366?** A patch was published on 2026-08-26: Fixed in Kids Mode 4.9.7.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-15366 attacked?** It is attacked with physical access, in a network appliance.

**Am I affected by CVE-2026-15366?** Check whether you run Vivo Kids Mode at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A control logic defect in a built-in webpage of vivo Kids Mode allows unauthorized access to local gallery photos. The vulnerability enables users to view photos directly within the Kids Mode interface, bypassing intended access restrictions. This is an access control bypass affecting Kids Mode versions below 4.9.7.0, which is the fixed version. The vulnerability requires physical access (AV:P) and has no prerequisites for authentication or user interaction. An attacker can view restricted photo content, with limited impact on confidentiality and integrity.

## Affected products

- vivo Kids Mode below 4.9.7.0

## Timeline

- 2026-08-26: disclosed
- 2026-08-26: patched: Fixed in Kids Mode 4.9.7.0

## References

- [https://www.vivo.com/en/support/security-advisory-detail?id=24](https://www.vivo.com/en/support/security-advisory-detail?id=24)

## Related threats

- [Vivo Kids Mode password verification bypass in pop-up logic](https://junglewise.ai/threats/cve-2026-15365-vivo-kids-mode-password-verification-bypass-in-pop-up-logic)