PatchSiren cyber security CVE debrief
CVE-2026-12189 Moovit CVE debrief
A flaw has been found in Moovit Bus & Public Transit App 1.18 on Android. This affects an unknown part of the component com.tranzmate. Executing a manipulation can lead to improper authorization in handler for custom url scheme. The attack can only be executed locally. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Vendor
- Moovit
- Product
- Bus & Public Transit App
- CVSS
- LOW 1.9
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-14
- Original CVE updated
- 2026-06-15
- Advisory published
- 2026-06-14
- Advisory updated
- 2026-06-15
Who should care
Users of Moovit Bus & Public Transit App 1.18 on Android
Technical summary
The vulnerability is located in the com.tranzmate component of the Moovit Bus & Public Transit App 1.18 on Android. An attacker can exploit this vulnerability by executing a manipulation that leads to improper authorization in the handler for custom URL schemes. This attack can only be executed locally.
Defensive priority
LOW
Recommended defensive actions
- Update to a patched version if available
- Use secure practices when handling custom URL schemes
- Monitor the application for suspicious local activity
Evidence notes
The CVSS score for this vulnerability is 1.9, indicating a LOW severity. The CVSS vector is CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.
Official resources
CVE-2026-12189 was published on 2026-06-14T23:16:35.623Z and modified on 2026-06-15T16:16:32.440Z.