An authorization issue identified in Apple’s operating systems, now addressed through improved state management, still allows an installed application to read protected user information without performing the proper permission checks. The weakness, classified as CWE-200, lets an app acquire sensitive data that it is not explicitly authorized to access, thereby compromising user confidentiality. The vulnerability does not enable direct device control or code execution, but it permits disclosure of private information.

Apple OSes affected include iOS, iPadOS, macOS, visionOS, and watchOS on all releases earlier than iOS 18.7.9, iOS 26.4, iPadOS 18.7.9, iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, visionOS 26.4, and watchOS 26.4. Until those specific versions are installed, any device running those operating systems remains vulnerable to an app reading sensitive user data.

Reported CVSS is 5.5 and EPSS is below 1%, indicating a moderate severity and a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting no large‑scale or notable exploits to date. The likely attack vector is an application that has already been installed on the device; based on the description, it is inferred that such an app could leverage the flaw to read sensitive user data if it does not enforce proper authorization.