A permissions issue was identified that allows an application to bypass restrictions and fingerprint a user. The primary impact is the potential to uniquely identify a user across services, thereby compromising privacy. The weakness can be described as improper privilege management.

Apple devices running iOS, iPadOS, tvOS, visionOS, or watchOS are affected. The issue exists in all releases prior to the 26.4 update for each platform, which addresses the problem.

The CVSS score of 6.5 indicates moderate risk, while the EPSS score below 1% shows a low current exploitation likelihood, and the vulnerability is not listed in KEV. An attacker would need to install a malicious or compromised application that exploits the over‑permitted permission to collect identifying information. Once the app is executed, the attacker could fingerprint the user without requiring additional credentials.