A permissions issue allows a shortcut to read files that are normally inaccessible to the Shortcuts app. The flaw stems from insufficient validation of file access permissions, which is categorized as a Permission Management weakness (CWE-276). If exploited, an attacker could obtain sensitive data or code from protected locations, potentially compromising the confidentiality of user data. The advisory notes that the fix was applied in recent releases of iPadOS and macOS.

Apple iPadOS 17.7.6 and later versions are affected, as well as macOS Sequoia 15.4, 15.7.2, Sonoma 14.7.5, 14.8.2, Tahoe 26.1, and Ventura 13.7.5. Devices running any older versions of these operating systems are vulnerable and should be upgraded.

The CVSS score of 9.8 indicates a high severity with the potential for complete data exposure. The EPSS score of less than 1% suggests that the exploitation rate is currently low, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is a malicious or corrupted shortcut that a user is asked to run. Once the shortcut is executed, the App’s permission model is bypassed, allowing the shortcut to access protected files.