PT-2026-25771 · Citydata · Citychat

Fxizenta + 1 · Published 2026-03-16 · Updated 2026-03-16 · CVE-2026-4251

Positive Technologies (AI Summary)

CVSS v3.1

2.5

Low

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions CityData CityChat versions prior to 0.12.7

Description An issue exists in the ai.citydata.citychat component within the file 'resources/assets/flutter assets/assets/credentials.json'. A manipulation of this file can lead to the unprotected storage of credentials. This attack requires local access and is characterized by high complexity, making exploitation difficult.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-255

CWE-256

Related Identifiers

CVE-2026-4251

Affected Products

Citychat

References · 5

• 🔥 https://notion.so/Google-Cloud-Service-Account-Key-Exposure-Leading-to-Dialogflow-Data-Access-in-ai-citydata-citychat-3192de3f97fb80ca9739ebc6329c8449?source=copy_link · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-4251 · Security Note
• https://vuldb.com/?submit.771436 · Note
• https://vuldb.com/?ctiid.351209 · Note
• https://vuldb.com/?id.351209 · Note