A missing authorization check allows a malicious application to gain root privileges on affected Apple operating systems. This flaw can be leveraged to execute privileged code, modify system files or settings, and potentially install persistence mechanisms. The primary weakness is identified as CWE-862: Missing Authorization. The vulnerability directly compromises confidentiality, integrity, and availability for any user who runs the malicious app.

Apple iOS 26.3, iPadOS 26.3, macOS Sequoia 15.7.4, macOS Tahoe 26.3, visionOS 26.3 are affected. Broad OS versions of iPhone, iPad, Mac and visionOS devices are impacted, as reflected in the cpe strings for iOS, iPadOS, macOS and visionOS.

The CVSS score of 7.8 indicates high severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Attackers would typically install a malicious app on the device, which then abuses the missing authorization to elevate privileges. No external conditions beyond the ability to run an app on the device are required.