EUVD Vulnerability Catalog

EUVD-2026-68596

Severity: CRITICAL Base Score: 9.3 CVSS Version: 3.1

Vulnerability Description

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Digitální a informační agentura (DIA) eObčanka-Identifikace on MacOS enables an attacker to register a custom URL scheme (czeeopauth://) for parameterized application execution. Prior to version 3.6.0, incoming URL parameters were passed to the compiled AppleScript wrapper using concatenation without sufficient sanitization.

CVSS Vector Analysis

Below is the complete, human-readable breakdown of the CVSS metric string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

▪ Attack Vector (AV): Network

▪ Attack Complexity (AC): Low

▪ Privileges Required (PR): None

▪ User Interaction (UI): Required

▪ Scope (S): Changed

▪ Confidentiality Impact (C): High

▪ Integrity Impact (I): High

▪ Availability Impact (A): None

Affected Vendors & Systems

Vendor Ministry of the Interior (MVČR)

References & Advisory Links

https://info.identita.gov.cz/eop/BezpecnostniOznameni/CVE-2026-59111.aspx

Metadata Profile

Database Authority

European Union Agency for Cybersecurity (ENISA) EUVD

Assigner

ENISA

EPSS Probability

Known Aliases

CVE-2026-59111 GHSA-vj9g-x7fg-rr79

Published On

2026-08-31

Last Updated

2026-08-31