A privacy flaw in Apple operating systems allows an application to obtain sensitive user data that it should not access, due to inadequate access controls. The vulnerability was mitigated by improving the operating system’s entitlement checks, but only versions newer than 27 include the fix. The flaw exposes user information to any app that can exploit the weakened restrictions, potentially compromising confidentiality.

The affected platforms are Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. All releases before version 27 are vulnerable; the fix is applied starting with iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27.

The EPSS score is less than 1% and the vulnerability is not listed in CISA’s KEV catalog, indicating that exploitation is unlikely at present. The CVSS score of 5.5 indicates moderate severity. The flaw permits an app to read protected data without proper authorization, representing a moderate risk if the operating system remains on an affected version. With no known public exploits, the likelihood of exploitation remains uncertain, but the potential impact is significant for end‑user privacy.