Unauthenticated HTTP File Exposure in Gallery – Private Photo Vault (CVE-2026-77884)

Summary of Key Vulnerability Information Vulnerability Overview Vulnerability Name: Unauthenticated Local-Network HTTP File Exposure Vulnerability Type: CWE-732 Unrestricted Access (APK Content Provider) CVSS v4.0 Base Score: 7.1 (High) CVE Number: CVE-2026-77884 Root Cause: The application exposes an Android service that serves files without binding access to authenticated user actions or restricting it to trusted clients. The service listens on TCP port 8080 and directly serves files and directory listings from Android external storage, requiring no PIN, credentials, cookies, Bearer tokens, pairing codes, or user confirmation. Scope of Impact Affected Product: Gallery – Private Photo Vault Affected Version: 1.0.41 Vendor: Brain Trust Remotely Exploitable: Yes (an attacker on the same Wi-Fi or adjacent local network can send HTTP requests to read and enumerate directories and files) Remote Exploitability: Yes Exploitability: Yes (PoC provided) Remediation Current Status: There is currently no patch available for this vulnerability. Mitigation Recommendations: Since the service is unauthenticated, it is recommended to isolate the device from untrusted local networks or wait for the vendor to release a fixed version. PoC Code Block Prerequisites Install Gallery – Private Photo Vault 1.0.41 on an Android device Launch the application once Place the Android device and the attacker’s workstation on the same Wi-Fi or adjacent local network Obtain the IP address of the Android device Step 1: Confirm the package process is listening Expected Result: Step 2: Request the HTTP root path from the workstation Expected Result: The server returns HTTP 200 OK The response includes an HTML directory listing No PIN, credentials, cookies, Bearer token, pairing code, or other authentication material is required Step 3: Request a listed path Step 4: Download a listed file Expected Result: The file is served directly by the HTTP server The app’s in-app lock screen/PIN is not queried Timeline September 19, 2026: Vulnerability discovered September 19, 2026: Vendor contacted September 14, 2026: Public disclosure

Goal Reached Thanks to every supporter — we hit 100%!

Unauthenticated HTTP File Exposure in Gallery – Private Photo Vault (CVE-2026-77884)