Open redirect in Creema marketplace app for Android and iOS
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-601.
Summary
CREEMA LTD. "Handmade Marketplace App - Creema" for Android is affected before 2.436.0, and "Creema - Handmade Marketplace App" for iOS is affected before 2.432.0. An open redirect (CWE-601) lets a specially crafted URL display a website chosen by the attacker within the app's screen. A remote attacker without privileges needs the user to open that URL, which can lead to phishing.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
"Handmade Marketplace App - Creema" provided by CREEMA LTD. contains an open redirect vulnerability. When accessing a specially crafted URL, a website set up by the attacker may be displayed within the app's screen of a user. As a result, the user may become a victim of a phishing attack.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| CREEMA LTD. | "Handmade Marketplace App - Creema" for Android | before 2.436.0 | 2.436.0 | Patch available | CNA |
| CREEMA LTD. | "Creema - Handmade Marketplace App" for iOS | before 2.432.0 | 2.432.0 | Patch available | CNA |
- "Handmade Marketplace App - Creema" for Android VendorCREEMA LTD. Affected before 2.436.0 Fixed in 2.436.0 Patch available CNA
- "Creema - Handmade Marketplace App" for iOS VendorCREEMA LTD. Affected before 2.432.0 Fixed in 2.432.0 Patch available CNA
Remediation
Update the Android app to 2.436.0 or later and the iOS app to 2.432.0 or later.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA "Handmade Marketplace App - Creema" for Android (CREEMA LTD.) Fixed in 2.436.0
- Fix · CNA "Creema - Handmade Marketplace App" for iOS (CREEMA LTD.) Fixed in 2.432.0
Timeline
- 2026-10-16 Threatist record created from CVE-2026-72528
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences