Vulnerability · Published Feb 3, 2026 · Assigned by CERT-PL

CVE-2025-11598Exposure of Confidential Information in mObywatel application

Low 1.0

In plain English

A low-severity security flaw in mObywatel from Centralny Ośrodek Informatyki. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 4.0)1.0Low

Exploit odds (30 days)0.2%top 92.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

In mObywatel iOS application an unauthorized user can use the App Switcher to view the account owner's personal information in the minimized app window, even after the login session has ended (reopening the app would require the user to log in). The data exposed depends on the last application view displayed before the application was minimized This issue was fixed in version 4.71.0

Affected products (as reported)

Vendor	Product	Versions
Centralny Ośrodek Informatyki	mObywatel	0 – before 4.71.0

Weakness: CWE-359 · Vector: CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://info.mobywatel.gov.pl/ product
https://cert.pl/posts/2026/02/CVE-2025-11598 third-party-advisory