# CVE-2026-21056: Samsung Health improper authorization in connected device info

Source: https://junglewise.ai/threats/cve-2026-21056-samsung-health-improper-authorization-in-connected-device-info  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-10. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2026-21056 · Severity: info · CVSS 4.8 · Published 2026-07-10

Samsung Health is a mobile application used for tracking fitness, nutrition, and sleep data. A security flaw in versions prior to 7.00.0.107 could allow a malicious app installed on the same device to access information about connected hardware, such as smartwatches or fitness trackers. This could lead to the unauthorized disclosure of device identifiers and connection details.

Technologies: [Samsung Health](https://junglewise.ai/threats/technologies/health). Vendors: [Samsung](https://junglewise.ai/threats/vendors/samsung).

## Quick answers

**Is CVE-2026-21056 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-21056 being exploited in the wild.

**How severe is CVE-2026-21056?** Informational severity, with a CVSS score of 4.8, published 10 July 2026.

**Which products and versions are affected?** Samsung Health prior to 7.00.0.107.

**Is there a fix for CVE-2026-21056?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-21056 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-21056?** Check whether you run Samsung Health at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper authorization vulnerability exists in the Samsung Health application due to insufficient access controls on internal components. A local attacker with low privileges (such as a malicious third-party application) can exploit this flaw to bypass intended restrictions and retrieve information regarding devices connected to the application. The vulnerability is rooted in the improper export or protection of application components, which fails to verify the authorization of the requesting process. Samsung has addressed this in version 7.00.0.107 by implementing proper access control checks.

## Affected products

- Samsung Mobile Samsung Health prior to 7.00.0.107

## Timeline

- 2026-07-07: advisory: Samsung Bulletin published
- 2026-07-10: disclosed: NVD publication date

## References

- [https://security.samsungmobile.com/serviceWeb.smsb?year=2026&month=07](https://security.samsungmobile.com/serviceWeb.smsb?year=2026&month=07)

## Related threats

- [Relative path traversal in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information.](https://junglewise.ai/threats/cve-2026-21082-relative-path-traversal-in-samsung-health-prior-to-version-7-0-0)
- [Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information.](https://junglewise.ai/threats/cve-2026-21077-incorrect-authorization-in-samsung-health-prior-to-version-7-0-0)
- [Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information.](https://junglewise.ai/threats/cve-2026-21076-incorrect-authorization-in-samsung-health-prior-to-version-7-0-0)
- [Improper authorization in Samsung Health prior to version 6.30.5.105 allows local attackers to access data in Samsung Health.](https://junglewise.ai/threats/cve-2025-21059-improper-authorization-in-samsung-health-prior-to-version-6-30-5)