What’s Vulnerable › Vulnerabilities

CVE-2025-11598: Exposure of Confidential Information in mObywatel application

• Severity: low (CVSS 1.0 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-03 · updated 2026-06-17
• Weakness: CWE-359

Description

In mObywatel iOS application an unauthorized user can use the App Switcher to view the account owner's personal information in the minimized app window, even after the login session has ended (reopening the app would require the user to log in). The data exposed depends on the last application view displayed before the application was minimized This issue was fixed in version 4.71.0

Affected products

• Centralny Ośrodek Informatyki mObywatel: before 4.71.0 — fixed in 4.71.0

How to fix

Upgrade to a fixed version: Centralny Ośrodek Informatyki mObywatel 4.71.0. Check the vendor advisory for mitigations.

References

• https://cert.pl/posts/2026/02/CVE-2025-11598
• https://info.mobywatel.gov.pl/

Get alerted when CVE-2025-11598 or the next vulnerability affects your stack