An authorization flaw caused by improper state management allows a malicious application to bypass user privacy settings on Apple devices. The flaw undermines the intended restrictions configured in the privacy preferences, potentially enabling the application to access or modify data that should remain private, thereby presenting a risk of unauthorized disclosure.

Apple iOS, iPadOS, and macOS devices are impacted. The vulnerability exists in iOS 18.7.10 and 27, iPadOS 18.7.10 and 27, macOS Golden Gate 27, macOS Sequoia 15.7.8, and macOS Sonoma 14.8.8. Devices running these or older versions must be updated to the listed fixed releases to eliminate the flaw.

The CVSS score of 5.5 signifies moderate severity, compromising confidentiality when successful. The EPSS score of less than one percent indicates a very low likelihood of exploitation in the wild, and the vulnerability is not currently cataloged in CISA KEV. Nevertheless, because any installed application can trigger the issue, the flaw functions as a local authorization bypass with measurable impact, warranting timely remediation.