GEO app CVE-2026-105271

Requires physical possession of or local access to a device that has the GEO app (ゲオアプリ) installed on Android or iOS, and the ability to read the application's local on-device storage where the user's password is written in cleartext (CWE-312). Exploitation is strictly limited by the physical attack vector (AV:P) - it cannot be performed remotely or over a network - and additionally requires that a user has saved/logged in credentials in the app (PR:L). It does not require user interaction. The practical exposure is a lost, stolen, shared, or forensically-examined device.

This is a genuinely low-to-moderate priority issue, consistent with its 4.3 (Medium) CVSS score, and the limiting factor is the attack vector rather than the impact. The provided CVSS 3.0 vector (AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) requires PHYSICAL access to the device plus low-level privileges (an app user), which is the dominant risk-reducing signal: this cannot be exploited remotely or at scale. The impact is scoped to confidentiality (C:H) - disclosure of a stored user password - with no integrity or availability effect, matching CWE-312 (cleartext storage). No EPSS score, KEV listing, or POC was provided in the input, so there is no evidence of exploitation probability or active abuse; the absence of these signals is itself consistent with a physical-access-only mobile credential-storage flaw, which is typically targeted (e.g., lost/stolen/forensically-examined device or a shared/compromised device) rather than widely weaponized. No signals conflict: the physical vector, authenticated privilege, and confidentiality-only impact all point the same direction. The main residual concern is credential reuse - a recovered cleartext password may unlock other services.

An attacker who gains physical access to a victim's unlocked or forensically-accessible device (e.g., a lost, stolen, shared, or seized phone) inspects the app's local storage for the GEO app (ゲオアプリ) and reads the user's password, which is stored in cleartext. Because passwords are frequently reused, the recovered credential may then be tried against the victim's other accounts. No public exploit code was provided, and exploitation is bounded by the need for physical device access.