CVE-2026-12189: Moovit Custom URL Handler Authorization Bypass on Android

Technical summary

CVE-2026-12189 is an improper authorization vulnerability in Moovit 1.18's com.tranzmate component affecting the custom URL scheme handler. The flaw stems from insufficient authorization checks (CWE-285) and improper resource validation (CWE-939) when processing custom URL schemes. An authenticated local attacker can invoke malicious custom URLs to bypass intended access controls, potentially achieving information disclosure, data modification, or denial of service within the app's context. The CVSS 3.1 score of 5.3 (MEDIUM) reflects the local attack vector and user-level privilege requirement, though impact spans confidentiality, integrity, and availability.

Business impact

For organizations deploying Moovit for employee transit planning or commuter coordination, this vulnerability could expose user location history, transit patterns, or saved locations to compromised devices. On shared or managed devices, a lower-privileged user could access or modify another user's transit data or preferences. The risk is particularly acute in BYOD environments or on devices with multiple user accounts. Reputational and compliance implications depend on whether transit data qualifies as personal information under applicable privacy regulations.

Affected systems

Moovit Bus & Public Transit App version 1.18 running on Android devices is affected. The specific Android API level, device manufacturer, or app variant distribution is not detailed in available disclosures. Organizations should verify whether their user base has updated beyond version 1.18, as patch availability from the vendor has not been confirmed due to the vendor's non-response to disclosure.

Exploitability

Exploitation requires local access to an Android device where Moovit 1.18 is installed and the attacker holds local user privileges. No remote exploitation is possible. Public exploit code is available, lowering the technical bar for attack execution. The attack does not require user interaction once device access is obtained, though the attacker must be able to invoke custom URL schemes (e.g., via adb, app interaction, or malicious companion app). Overall exploitability is moderate given the local-only requirement and the existence of public tooling.

Remediation

Users should update Moovit to the latest available version on Google Play Store as soon as possible. Verify the version number post-update to confirm it exceeds 1.18. Organizations managing Android devices should enforce app update policies and consider restricting Moovit installation on shared or multi-user devices until a patch is confirmed. Since the vendor did not acknowledge the disclosure, independent verification of fix status in newer versions is recommended before full remediation claim. Monitor vendor communications and security advisories for official patch confirmation.

Patch guidance

Check the Google Play Store app listing for Moovit Bus & Public Transit App and install any available update. The current version number should be confirmed post-installation. Due to the vendor's non-responsiveness to early disclosure, there is no official vendor advisory with a confirmed patched version number at this time. Cross-reference with security bulletins or app release notes to verify the vulnerability is addressed in the version you deploy. If no patch is available, consider deploying mitigations such as device-level access controls or containerization.

Detection guidance

Monitor for unusual custom URL scheme invocations targeting Moovit (com.tranzmate package). On managed Android devices, use Mobile Device Management (MDM) tools to audit app version inventory and flag devices running Moovit 1.18. Inspect device logs for failed authorization events or unexpected app interactions. Behavioral indicators include repeated attempts to access Moovit data or settings via custom URL handlers from unexpected processes. Network-based detection is limited due to the local-only nature of the attack, but endpoint detection and response (EDR) solutions on Android can flag suspicious inter-process communication.

Why prioritize this

This vulnerability merits prompt but not critical attention. Although public exploit code exists and local attackers can bypass authorization, the attack surface is limited to devices with Moovit installed and requires local privilege. For organizations with significant BYOD or shared device adoption, prioritize patching higher. For enterprise-only environments with restricted device access, prioritize after critical and high-severity issues affecting remote services. The vendor's non-response adds uncertainty and argues for faster internal testing and deployment of any available update.

Risk score, explained

The CVSS 3.1 score of 5.3 (MEDIUM) reflects a local attack vector (AV:L), low attack complexity (AC:L), low privilege requirement (PR:L), no user interaction (UI:N), and uniform scope (S:U). All three impact categories—confidentiality, integrity, and availability—are marked as low (L), consistent with the app-level scope of the attack. The score appropriately captures that while impact is broad, it is bounded to a single application on a local device. The presence of public exploits does not adjust the CVSS base score but elevates real-world risk.

Frequently asked questions