[Japanese]

JVNDB-2026-000151

Smartphone application "Vehicle Inspection Certificate Viewer" vulnerable to sensitive information disclosure

Overview

The smartphone application "Vehicle Inspection Certificate Viewer" provided by the Ministry of Land, Infrastructure, Transport and Tourism includes an API integration feature for operators handling vehicle inspection certificates.
The specifications for the API integration contain the following vulnerability:
  • Insertion of Sensitive Information Into Sent Data (CWE-201) - CVE-2026-75559
Ijiri, Sho reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
CVSS Severity (What is CVSS?)

CVSS V3 Severity:
Base Metrics 5.3 (Medium) [IPA Score]
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None
CVSS v4 Severity
Base Metrics: 6.9 (Medium) [IPA Score]
  • Access Vector (AV): Network
  • Attack Complexity (AC): Low
  • Attack Requirements (AT): None
  • Privileges Required (PR): None
  • User Interaction (UI): None
    • Vulnerable System Impact
  • Confidentiality Impact (VC): Low
  • Integrity Impact (VI): None
  • Availability Impact (VA): None
    • Subsequent System Impact
  • Confidentiality Impact (SC): None
  • Integrity Impact (SI): None
  • Availability Impact (SA): None
Affected Products


Ministry of Land, Infrastructure, Transport and Tourism
  • Vehicle Inspection Certificate Viewer (for Android) ver.6.2.0 and earlier
  • Vehicle Inspection Certificate Viewer (for iOS) ver.6.2.0 and earlier

Impact

API integration credentials, including an access ID and access key, may be disclosed.
Solution

[Update the Application]
Update the application to the latest version according to the information provided by the developer.

Note that the developer has issued new access IDs and access keys to API users and has revoked the access IDs and access keys that may have been exposed.
Therefore, this vulnerability can no longer be exploited.
Vendor Information

Ministry of Land, Infrastructure, Transport and Tourism
CWE (What is CWE?)

  1. No Mapping(CWE-Other) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2026-75559
References

  1. JVN : JVN#94004488
Revision History

  • [2026/10/15]
      Web page was published

Date Public2026/10/15
Date First Published2026/10/15
Date Last Updated2026/10/15