CVE-2026-12189CWE-285CWE-939

Moovit Bus & Public Transit App com.tranzmate improper authorization in handler for custom url scheme

Medium · published June 14, 2026

CVSS v4.0
4.8
EPSS
0%
Percentile
1.0
In the wild
Unconfirmed
What it is

A flaw has been found in Moovit Bus & Public Transit App 1.18 on Android. This affects an unknown part of the component com.tranzmate. Executing a manipulation can lead to improper authorization in handler for custom url scheme. The attack can only be executed locally. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v4.0
4.8 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00105 · 1.0th percentile
Weaknesses
CWE-285 · Improper Authorization; CWE-939 · Improper Authorization in Handler for Custom URL Scheme
Published
2026-06-14T22:30Z
EPSS history
Timeline
  • 14 JUN 22:30Z
    Moovit Bus & Public Transit App com.tranzmate improper authorization in handler for custom url scheme
    cvelistv5