Improper Authorization in Moovit Bus & Public Transit App on Android
CVE-2026-12189

4.8MEDIUM

Key Information:

Vendor

Moovit

Status
Bus & Public Transit App
Vendor
CVE Published:
14 June 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-12189?

A vulnerability exists in the Moovit Bus & Public Transit App version 1.18 for Android, related to improper authorization within the component com.tranzmate. This flaw enables local attackers to exploit the URL scheme handler, which can lead to unauthorized actions within the application. The exploitation requires physical access to the device, making it crucial for users to be aware of security implications, as exploit methods have been publicly disclosed and the vendor has not acknowledged the issue. Awareness and proactive measures are essential for safeguarding sensitive user data.

Affected Version(s)

Bus & Public Transit App 1.18

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-12189 - Proof of Concept

References

https://vuldb.com/vuln/370835
vdb-entry
https://vuldb.com/vuln/370835/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-12189
third-party-advisory

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

honest_corrupt (VulDB User)
VulDB CNA Team
.