An authorization flaw in Apple iOS, iPadOS, macOS, and visionOS was addressed by improving state management. The vulnerability permits an application to gain unauthorized access to sensitive user data, potentially exposing personal information or compromising user privacy. This weakness represents a violation of access control boundaries and could be exploited to obtain data beyond the app’s intended permissions.

The issue affects Apple iOS and iPadOS devices running versions earlier than 26.1, macOS systems running earlier than Sequoia 15.7.2, Sonoma 14.8.2, or Tahoe 26.1, and visionOS versions before 26.1. Any device with an impacted operating system that runs applications with elevated rights may be susceptible until the specific releases are installed.

Based on the description, it is inferred that exploitation would require local or authenticated access, as the flaw involves state management that an application can manipulate. The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Once exploited, the attacker can read or transfer sensitive data from the device. The limited exploit probability combined with the moderate severity suggests monitoring the device environment, but the priority for patching remains high to eliminate the authorization breach.