An application can bypass required entitlement checks to avoid being recorded by the App Privacy Report, allowing it to collect or transmit data without the privacy safeguard that would normally be enforced. This flaw results in a violation of user privacy, with the potential for malicious or accidental data exposure. The weakness is a form of improper authorization or access control (CWE‑285).

Apple iOS and iPadOS devices running versions prior to iOS 18.7.9 and iPadOS 18.7.9, as well as prior to iOS 26.4 and iPadOS 26.4 are affected. The vulnerability is fixed in the 18.7.9/26.4 releases.

There is no EPSS data or KEV listing, but the flaw permits a local or remote application to subvert system-enforced privacy protections once it is installed. Because the issue is a direct entitlement bypass, any app that can install on the device can potentially exploit it, although no public exploit is known at this time. The risk is significant for user privacy and compliance with data protection regulations.