CVE-2026-12189
Received Received - Intake
Improper Authorization in Moovit Bus & Public Transit App

Publication date: 2026-06-14

Last updated on: 2026-06-14

Assigner: VulDB

Description
A flaw has been found in Moovit Bus & Public Transit App 1.18 on Android. This affects an unknown part of the component com.tranzmate. Executing a manipulation can lead to improper authorization in handler for custom url scheme. The attack can only be executed locally. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-14
Last Modified
2026-06-14
Generated
2026-06-15
AI Q&A
2026-06-15
EPSS Evaluated
N/A
NVD
CVE-2026-12189
EUVD
EUVD-2026-36668
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
moovit bus_and_public_transit_app 1.18
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-939 The product uses a handler for a custom URL scheme, but it does not properly restrict which actors can invoke the handler using the scheme.
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a flaw found in the Moovit Bus & Public Transit App version 1.18 on Android. It affects an unknown part of the component com.tranzmate. The issue arises from improper authorization handling in the handler for a custom URL scheme. This means that an attacker could manipulate the app locally to bypass authorization checks.

The attack can only be executed locally, and the exploit has already been published and may be used by attackers. The vendor was contacted early about this issue but did not respond.

Impact Analysis

The vulnerability can lead to improper authorization, which means an attacker with local access to the device could potentially perform actions or access data that should be restricted. This could result in limited confidentiality, integrity, and availability impacts on the app's data or functionality.

According to the CVSS v3.1 score of 5.3, the impact is moderate, affecting confidentiality, integrity, and availability to a limited extent.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12189. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart