CVE-2026-59003 in Android
Summary
by MITRE • 11/02/2026
In getSubscriptionProperty of SubscriptionManagerService.java, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability identified in the getSubscriptionProperty method within SubscriptionManagerService.java represents a critical flaw rooted in insufficient access control mechanisms, specifically categorized under CWE-284 Improper Access Control and often associated with CWE-798 Use of Hard-coded Credentials if sensitive data is exposed without proper authentication. This defect allows for unauthorized local information disclosure because the service fails to verify whether the requesting entity possesses the necessary permissions before retrieving or returning subscription-related properties. In Android-based systems, where SubscriptionManagerService typically handles SIM card and mobile network subscription details, such a lapse can expose highly sensitive personal and operational data including IMSI numbers, phone numbers, carrier settings, and potentially authentication tokens associated with cellular services. The absence of a permission check means that any application running on the device, regardless of its privilege level or intended functionality, can invoke this method to extract these confidential attributes without triggering security exceptions or requiring user consent.
From an operational perspective, the impact of this vulnerability is significant as it facilitates local information disclosure with no additional execution privileges required for exploitation. This implies that even low-privileged applications installed on a compromised device can leverage this flaw to gather intelligence about the user's identity and network configuration. Such data aggregation can serve as a precursor to more severe attacks, including SIM swapping fraud, targeted phishing campaigns, or bypassing two-factor authentication mechanisms that rely on SMS delivery tied to specific phone numbers. Furthermore, because user interaction is not needed for exploitation, an attacker does not need to trick the victim into clicking malicious links or granting permissions through deceptive UI patterns; the exploit can be executed silently in the background by a rogue application already present on the system. This characteristic aligns with ATT&CK technique T1005 Data from Local System and potentially T1497 Virtualization/Sandbox Evasion if used to detect security tools, though primarily it falls under data exfiltration via local access.
Mitigation strategies must focus on implementing strict permission verification within the getSubscriptionProperty method before any sensitive data is returned. Developers should ensure that calls to this service are gated by appropriate Android permissions such as READ_PHONE_STATE or specific subscription management permissions defined in the platform manifest, ensuring only authorized system components or privileged applications can access these properties. Additionally, integrating runtime checks using Context.checkCallingPermission() or similar framework methods during execution will prevent unauthorized callers from retrieving data even if they have static permission declarations that might be bypassed through other means. It is also advisable to review all public APIs within the SubscriptionManagerService for similar omissions in access control logic and conduct a comprehensive audit of inter-process communication boundaries to ensure that sensitive state changes or retrievals are consistently protected by robust authentication and authorization checks aligned with industry best practices for secure software development.