A recent authorization flaw in Apple operating systems allows an application to add contacts without user consent due to insufficient validation. The issue is resolved in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, visionOS 26.6, and watchOS 26.6. An application could use this weakness to populate the device's address book, potentially exposing private data or enabling further attacks.

Apple iOS, iPadOS, macOS (Tahoe), visionOS, and watchOS are affected. The vulnerability exists in all releases released before version 26.6 of each OS.

EPSS data is available and indicates a < 1% exploitation probability. The CVSS score of 9.8 reflects a critical severity with remote impact. The flaw was not listed in CISA KEV. The likely attack vector is an application running on the device with app‑level privileges, potentially able to add contact records without user consent. With no publicly available exploit, the risk remains moderate because local application access is required, but the impact could be significant by corrupting the device's address book.