Description
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27. An app may be able to access sensitive user data.
Published: 2026-09-14
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized access to sensitive user data
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is a permissions issue that could allow an application to read or modify sensitive user data it should not be able to, potentially leading to privacy compromise. The flaw arises from insufficient restriction of app capabilities, permitting access to information normally reserved for system processes.

Affected Systems

Apple iOS and iPadOS devices running versions earlier than 27 are impacted; the issue is fixed in iOS 27 and iPadOS 27.

Risk and Exploitability

The EPSS score is < 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in CISA KEV. The CVSS score is 5.5, indicating moderate severity. The likely attack vector involves a malicious or compromised application that exploits the permissions oversight to obtain protected data. As such, the risk remains moderate until a patch is applied.

Generated by OpenCVE AI on September 20, 2026 at 21:09 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to iOS 27 or iPadOS 27, which contain the permission restrictions that fix the issue.
  • If an immediate update is not possible, limit the app’s permissions or uninstall the app until the update can be applied.
  • Keep system security settings enabled, such as App Store sandboxing and runtime permissions controls, and monitor device logs for any unauthorized data access.

Generated by OpenCVE AI on September 20, 2026 at 21:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://support.apple.com/en-us/149034 cve-icon cve-icon
History

Sun, 20 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Title Permissions Issue Allowing to Access Sensitive User Data in iOS and iPadOS

Wed, 16 Sep 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Apple ipados
Apple iphone Os
CPEs cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
Vendors & Products Apple ipados
Apple iphone Os

Wed, 16 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 16 Sep 2026 13:00:00 +0000

Type Values Removed Values Added
Title iOS/iPadOS Permission Flaw Allowing Unauthorized Data Access
Weaknesses CWE-284

Tue, 15 Sep 2026 11:15:00 +0000

Type Values Removed Values Added
Title iOS/iPadOS Permission Flaw Allowing Unauthorized Data Access
Weaknesses CWE-284

Tue, 15 Sep 2026 03:45:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple ios And Ipados
Vendors & Products Apple
Apple ios And Ipados

Mon, 14 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
Description A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27. An app may be able to access sensitive user data.
References

Subscriptions

Apple Ios And Ipados Ipados Iphone Os
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-09-16T13:23:34.236Z

Reserved: 2026-09-08T16:43:41.871Z

Link: CVE-2026-86878

cve-icon Vulnrichment

Updated: 2026-09-16T13:23:21.235Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-14T21:17:38.797

Modified: 2026-09-16T15:29:52.507

Link: CVE-2026-86878

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T21:15:04Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor