CVE-2026-4251

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4251", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-03-16T06:10:42.442Z", "datePublished": "2026-03-16T16:02:08.596Z", "dateUpdated": "2026-03-16T18:17:54.591Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-16T16:02:08.596Z"}, "title": "CityData CityChat ai.citydata.citychat credentials.json credentials storage", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-256", "lang": "en", "description": "Unprotected Storage of Credentials"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-255", "lang": "en", "description": "Credentials Management"}]}], "affected": [{"vendor": "CityData", "product": "CityChat", "versions": [{"version": "0.12.0", "status": "affected"}, {"version": "0.12.1", "status": "affected"}, {"version": "0.12.2", "status": "affected"}, {"version": "0.12.3", "status": "affected"}, {"version": "0.12.4", "status": "affected"}, {"version": "0.12.5", "status": "affected"}, {"version": "0.12.6", "status": "affected"}], "modules": ["ai.citydata.citychat"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in CityData CityChat up to 0.12.6 on Android. Affected by this vulnerability is an unknown functionality of the file resources/assets/flutter_assets/assets/credentials.json of the component ai.citydata.citychat. Executing a manipulation can lead to unprotected storage of credentials. The attack requires local access. A high complexity level is associated with this attack. The exploitation appears to be difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2, "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "LOW"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 2.5, "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 2.5, "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 1, "vectorString": "AV:L/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-03-16T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-03-16T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-03-16T07:16:06.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "fxizenta (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/?id.351209", "name": "VDB-351209 | CityData CityChat ai.citydata.citychat credentials.json credentials storage", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/?ctiid.351209", "name": "VDB-351209 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.771436", "name": "Submit #771436 | CITYDATA CityChat(ai.citydata.citychat) 0.12.6 Google Cloud Service Account Key Exposure", "tags": ["third-party-advisory"]}, {"url": "https://www.notion.so/Google-Cloud-Service-Account-Key-Exposure-Leading-to-Dialogflow-Data-Access-in-ai-citydata-citychat-3192de3f97fb80ca9739ebc6329c8449?source=copy_link", "tags": ["exploit"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-16T18:17:44.521821Z", "id": "CVE-2026-4251", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T18:17:54.591Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-4251", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-16T18:17:44.521821Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T18:17:50.345Z"}}], "cna": {"title": "CityData CityChat ai.citydata.citychat credentials.json credentials storage", "credits": [{"lang": "en", "type": "reporter", "value": "fxizenta (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 2.5, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 2.5, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 1, "vectorString": "AV:L/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "CityData", "modules": ["ai.citydata.citychat"], "product": "CityChat", "versions": [{"status": "affected", "version": "0.12.0"}, {"status": "affected", "version": "0.12.1"}, {"status": "affected", "version": "0.12.2"}, {"status": "affected", "version": "0.12.3"}, {"status": "affected", "version": "0.12.4"}, {"status": "affected", "version": "0.12.5"}, {"status": "affected", "version": "0.12.6"}]}], "timeline": [{"lang": "en", "time": "2026-03-16T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-03-16T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-03-16T07:16:06.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.351209", "name": "VDB-351209 | CityData CityChat ai.citydata.citychat credentials.json credentials storage", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/?ctiid.351209", "name": "VDB-351209 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.771436", "name": "Submit #771436 | CITYDATA CityChat(ai.citydata.citychat) 0.12.6 Google Cloud Service Account Key Exposure", "tags": ["third-party-advisory"]}, {"url": "https://www.notion.so/Google-Cloud-Service-Account-Key-Exposure-Leading-to-Dialogflow-Data-Access-in-ai-citydata-citychat-3192de3f97fb80ca9739ebc6329c8449?source=copy_link", "tags": ["exploit"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in CityData CityChat up to 0.12.6 on Android. Affected by this vulnerability is an unknown functionality of the file resources/assets/flutter_assets/assets/credentials.json of the component ai.citydata.citychat. Executing a manipulation can lead to unprotected storage of credentials. The attack requires local access. A high complexity level is associated with this attack. The exploitation appears to be difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-256", "description": "Unprotected Storage of Credentials"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-255", "description": "Credentials Management"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-16T16:02:08.596Z"}}}, "cveMetadata": {"cveId": "CVE-2026-4251", "state": "PUBLISHED", "dateUpdated": "2026-03-16T18:17:54.591Z", "dateReserved": "2026-03-16T06:10:42.442Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-03-16T16:02:08.596Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["ai.citydata.citychat"], "product": "CityChat", "vendor": "CityData", "versions": [{"status": "affected", "version": "0.12.0"}, {"status": "affected", "version": "0.12.1"}, {"status": "affected", "version": "0.12.2"}, {"status": "affected", "version": "0.12.3"}, {"status": "affected", "version": "0.12.4"}, {"status": "affected", "version": "0.12.5"}, {"status": "affected", "version": "0.12.6"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in CityData CityChat up to 0.12.6 on Android. Affected by this vulnerability is an unknown functionality of the file resources/assets/flutter_assets/assets/credentials.json of the component ai.citydata.citychat. Executing a manipulation can lead to unprotected storage of credentials. The attack requires local access. A high complexity level is associated with this attack. The exploitation appears to be difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Se determin\u00f3 una vulnerabilidad en CityData CityChat hasta la versi\u00f3n 0.12.6 en Android. Afectada por esta vulnerabilidad es una funcionalidad desconocida del archivo resources/assets/flutter_assets/assets/credentials.json del componente ai.citydata.citychat. Ejecutar una manipulaci\u00f3n puede llevar al almacenamiento no protegido de credenciales. El ataque requiere acceso local. Un alto nivel de complejidad est\u00e1 asociado con este ataque. La explotaci\u00f3n parece ser dif\u00edcil. El exploit ha sido divulgado p\u00fablicamente y puede ser utilizado. El proveedor fue contactado tempranamente sobre esta divulgaci\u00f3n, pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-4251", "lastModified": "2026-06-17T10:56:18.330", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "HIGH", "accessVector": "LOCAL", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 1.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:H/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 1.5, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 2.5, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4251", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-16T18:17:44.521821Z", "version": "2.0.3"}}]}, "published": "2026-03-16T17:16:31.840", "references": [{"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.351209"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.351209"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.771436"}, {"source": "cna@vuldb.com", "url": "https://www.notion.so/Google-Cloud-Service-Account-Key-Exposure-Leading-to-Dialogflow-Data-Access-in-ai-citydata-citychat-3192de3f97fb80ca9739ebc6329c8449?source=copy_link"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-255"}, {"lang": "en", "value": "CWE-256"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.12.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.12.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.12.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.12.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.12.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.12.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.12.6"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "CityChat", "source": "cna", "vendor": "CityData"}, "product": "citychat", "vendor": "citydata"}], "analysis": {"en": {"generated_at": "2026-03-17T11:51:17.887454+00:00", "value": {"mitigation_remediation": ["Apply the vendor\u2019s patch or upgrade to a version newer than 0.12.6 when available. If no patch is released, immediately restrict local read/write access to the credentials.json file. Consider removing or encrypting credentials.json and moving sensitive data to a secure store that requires explicit authorization. Monitor the vendor\u2019s support pages for updates or advisories and verify that the device firmware or app version has been updated. Verify that any device with local storage permissions are configured to limit unauthorized file system access."], "summary": {"action": "Patch", "impact": "Credential Exposure"}, "threat_synthesis": {"affected_systems": "CityData CityChat versions up to 0.12.6 running on Android are affected. The exact list of affected versions is not explicitly provided in the source information. The product vendor is identified as CityData, and the component in question is ai.citydata.citychat.", "description_and_impact": "The vulnerability allows an attacker with local access to manipulate the credentials.json file located in the file resources/assets/flutter_assets/assets/credentials.json of the ai.citydata.citychat component of CityData CityChat. This results in unprotected storage of credentials, effectively exposing sensitive authentication information. The weakness is identified as CWE-255 (Plaintext Storage of Sensitive Information) and CWE-256 (Improper Restriction of Default Permissions). The primary impact is disclosure of credentials, potentially allowing further unauthorized access to services tied to those credentials. The attack is difficult to execute and requires a high level of complexity, but because the exploit is publicly disclosed it remains a concern for devices that have not been patched or do not enforce strict local access controls.", "risk_and_exploitability": "The CVSS score of 2 indicates a low severity rating. EPSS information is not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack requires local access and a high complexity level, making exploitation difficult, but the public disclosure of the exploit means it could be used opportunistically on vulnerable devices. Consequently, the overall risk is low to moderate, but the confidentiality impact warrants deferral until an official fix or alternative mitigation can be applied."}}}}, "created": "2026-03-17T09:52:36.015906+00:00", "updated": "2026-03-24T10:50:18.057541+00:00", "vendors": ["citydata", "citydata$PRODUCT$citychat"]}