An authorization flaw in Apple’s operating systems allows selected third‑party applications to read protected user information without proper permission checks. The vulnerability is classified as CWE‑200, meaning that an app could obtain sensitive data that it is not explicitly authorized to access. While the flaw does not provide a direct path to system compromise or full code execution, it enables the disclosure of private user data, potentially impacting confidentiality.

The issue affects iOS, iPadOS, macOS, visionOS, and watchOS platforms on all releases earlier than iOS 26.4, iPadOS 26.4, macOS Sequoia 15.7.5, macOS Tahoe 26.4, visionOS 26.4, and watchOS 26.4. Until those specific versions are installed, any device within these operating systems is susceptible.

Reported CVSS is 5.5 and EPSS is below 1%, indicating a moderate severity and a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting no large‑scale or notable exploits to date. The likely attack vector is an application that has already been installed on the device; based on the description, it is inferred that such an app could leverage the flaw to read sensitive user data if it does not enforce proper authorization.