CVE-2025-11598
Exposure of Confidential Information in mObywatel application
- State
- Published
- Severity
- 1.0 Low
- Published
- Feb 3, 2026
- Updated
- Feb 3, 2026
- Reserved
- Oct 10, 2025
Description
In mObywatel iOS application an unauthorized user can use the App Switcher to view the account owner's personal information in the minimized app window, even after the login session has ended (reopening the app would require the user to log in). The data exposed depends on the last application view displayed before the application was minimized
This issue was fixed in version 4.71.0
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 1.0 Low | CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | CERT-PL |
Weaknesses
- CWE-359 Exposure of Private Personal Information to an Unauthorized Actor
Affected Products
| Product | Versions |
|---|---|
mObywatelCentralny Ośrodek Informatyki |
|
References
- https://info.mobywatel.gov.pl/product
- https://cert.pl/posts/2026/02/CVE-2025-11598third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.