CVE-2026-41872 describes a vulnerability in the "Kura Sushi Official App" for Android caused by improper certificate validation. This security weakness could enable an attacker to perform man-in-the-middle attacks on push notification traffic, potentially leading to eavesdropping or message alteration. The vulnerability affects app versions 2.0.11 through 3.9.10. The CVSS 3.0 base score is 7.4, reflecting high impact on confidentiality and integrity but no impact on availability. No vendor advisory or patch information is currently available, and the app is not a cloud service.

Successful exploitation of this vulnerability could result in an attacker intercepting or modifying push notifications sent to the affected app, compromising the confidentiality and integrity of the communication. This could lead to unauthorized disclosure of sensitive information or manipulation of app behavior via altered notifications. There is no indication of impact on system availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when using the affected app versions and avoid connecting over untrusted networks. Monitor for vendor updates regarding patches or mitigations.