An authorization issue was identified that, if not mitigated with improved state management, allows an installed application to read or use sensitive user data without proper consent. The flaw does not grant code execution or system takeover, but it permits an attacker to obtain information such as personal contacts, location, or other protected data gathered by the application. No enumeration of data types is disclosed in the advisory, but the impact is data exposure.

The vulnerability affects Apple iOS, iPadOS, and macOS prior to version 27. Users running these legacy operating systems are at risk until the operating system is updated to the fixed version 27 or later. The flaw is specific to the affected platforms and does not span other third‑party applications beyond the system itself.

The CVSS score of 5.5 indicates a medium severity. Combined with an EPSS score of < 1% and absence from the CISA KEV catalog, this suggests no known widespread exploits, but the potential for data exposure remains high. Based on the description, the likely attack vector is a malicious or compromised application that leverages the authorization hole, making this a local or medium‑risk attack vector. Given that the vulnerability could be abused through user‑installed apps, organizations should treat this as a high‑risk exposure until patches are applied.