by Kastro
Paper/Archive/CVE-2026-41872

CVE-2026-41872

EPG, Inc. "Kura Sushi Official App" for Android — "Kura Sushi Official App" provided by EPG, Inc.

EPSS 0.2%CVSS 9.1
critical.is priorityof 100
28
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 5.1.051 × 201.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

"Kura Sushi Official App" provided by EPG, Inc. is vulnerable to improper certificate validation. A man-in-the-middle attack may allow eavesdropping on, or altering, the communication on push notifications between the affected application and the relevant server.

Affected

ProductAffectedFixed inSource
"Kura Sushi Official App" for Androidfrom 2.0.11 to 3.9.10–CNA
"Kura Sushi Official App" for iOSfrom 2.0.11 to 3.9.10–CNA

Scores by source

jpcert (CNA)9.1CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
jpcert (CNA)7.4CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refplay.google.com/store/apps/details?id=jp.co.kura_corpo&hl=jarefapps.apple.com/jp/app/id942355925refjvn.jp/en/jp/JVN38632731