CVE-2026-72528 Details
Description
"Handmade Marketplace App - Creema" provided by CREEMA LTD. contains an open redirect vulnerability. When accessing a specially crafted URL, a website set up by the attacker may be displayed within the app's screen of a user. As a result, the user may become a victim of a phishing attack.
An open redirect vulnerability has been identified in the "Handmade Marketplace App - Creema" for iOS, provided by CREEMA LTD. This vulnerability allows an attacker to craft a URL that, when accessed, redirects the user to a website controlled by the attacker. The redirected site is displayed within the app, potentially leading to a phishing attack.
Users are advised to update the application to the latest version available on the App Store.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://apps.apple.com/jp/app/id916614208 | [email protected] | ProductVendor |
| https://jvn.jp/en/jp/JVN48627289/ | [email protected] | AdvisoryRemedy |
| https://play.google.com/store/apps/details?id=jp.creema.creema_android&hl=ja | [email protected] | ProductVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| CREEMA Handmade Marketplace App - Creema | < 2.436.0 (semver) < 2.432.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |