A permissions misconfiguration allows a user to view content that is meant to remain hidden when the device is locked. The flaw is a classic privilege management issue, identified as CWE‑276, where software permits access to restricted resources without verifying the lock‑screen state. The consequence is that an attacker who has physical access to the device can see otherwise protected data such as sensitive notifications or preview content, compromising user privacy.

Apple iOS and iPadOS devices affected by this issue are older releases that have not yet been updated to version 26.1. The vulnerability applies broadly to both iPhone and iPad operating systems, as both share the same lock‑screen code path for displaying restricted content.

The CVSS score of 2.4 classifies this flaw as low severity, and the EPSS score of less than 1 % indicates that real‑world exploitation is very unlikely. It is not listed in the CISA KEV catalog. The attack vector is inferred to be local: an attacker must have physical access to the device while it is locked and then view content presented on the lock screen. No remote code execution or denial of service capability is described. Given the low score and minimal exploitation probability, the overall risk to users is modest, but the privacy breach remains significant.