Rule Definition
Unlike Activities and Services, Content Providers can specify two different required permissions: one for reading and one for writing. This allows apps to be configured using the Principle of Least Privilege and recognizes how common designs are where some apps should be able to read certain data, other apps should be able to write that data, and still others should not be allowed to access the data at all. One common misconception about these permissions is that having the write permission automatically implies the read permission. The logic is that updating data (writing) is a more powerful permission than simply reading it and anyone that can write into a database should also be able to read from it. This is a fallacy, and the Android design, separating read and write

Remediation
It should define the read permission for content provider to restrict the access from others apps.

Violation Code Sample

Give a permission for both read and write:
<manifest xmlns:android="http://schemas.android.com/apk/res/android" 
 package="com.example.testapps.test1"> 
 ... 
        <permission android:name="myapp.permission"
                    android:protectionLevel="signature" />

        ...
        <provider android.name="com.example.testapps.test1.MailProvider" 
        android.authorities="com.example.testapps.test1.mailprovider" 
        android:exported  = "True" 
        android:Permission = "myapp.permission"
        </provider> 
  ... 
</manifest>

Only specify WritePermission
<manifest xmlns:android="http://schemas.android.com/apk/res/android" 
 package="com.example.testapps.test1"> 
 ... 
        <permission android:name="myapp.permission.WRITE"
                    android:protectionLevel="signature" />

        ...
        <provider android.name="com.example.testapps.test1.MailProvider" 
        android.authorities="com.example.testapps.test1.mailprovider" 
        android:exported  = "True" 
        android:writePermission = "myapp.permission.WRITE"
        </provider> 
  ... 
</manifest>

Fixed Code Sample

<manifest xmlns:android="http://schemas.android.com/apk/res/android" 
 package="com.example.testapps.test1"> 
 ... 
        <permission android:name="myapp.permission.READ"
                    android:protectionLevel="signature" />

        <permission android:name="myapp.permission.WRITE"
                    android:protectionLevel="signature" />
        ...
        <provider android.name="com.example.testapps.test1.MailProvider" 
        android.authorities="com.example.testapps.test1.mailprovider" 
        android:exported  = "True" 
        android:readPermission = "myapp.permission.READ"
        android:readPermission = "myapp.permission.WRITE"
        </provider> 
  ... 
</manifest>

https://developer.android.com/topic/security/best-practices https://developer.android.com/guide/topics/manifest/receiver-element.html#prmsn https://cwe.mitre.org/data/definitions/926.html