EUVD-2026-15155Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | While no CVSS score or EPSS probability is available, the risk profile is elevated due to the breadth of affected platforms and the information disclosure nature of the vulnerability. The absence of CVSS metrics prevents quantification of attack vector (likely local/app-based), attack complexity, and privilege requirements; however, the fact that 'an app may access sensitive user data' suggests relatively low attack complexity (application-level exploitation without network interaction). The vulnerability does not appear on the CISA Known Exploited Vulnerabilities catalog based on available intelligence, and no public proof-of-concept has been disclosed. However, the multi-platform scope (five major OS families) and the reliance on third-party app sandboxing as the security boundary indicates this is a real integrity concern for Apple's authorization model. Under SSVC framework, exploitation is likely possible (application developers can trigger state mismanagement), automatable (reproducible via app behavior), and causes total information disclosure. This warrants immediate patching despite lack of formal CVSS scoring. |
| Exploit ScenarioDerived | An attacker distributes a seemingly benign application through the App Store or sideloading mechanism that, upon installation, triggers the state management flaw during the authorization flow. When the user grants limited permission to access, for example, their photo library for a specific feature, the application exploits the improper state handling to retain that authorization beyond its intended scope, subsequently accessing the full photo library, contacts, or other sensitive data without additional user interaction or consent prompts. The attack requires no network connectivity or special privileges; it operates entirely at the application sandbox level and succeeds through local state confusion rather than privilege escalation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
An authorization bypass vulnerability in Apple's operating systems allows third-party applications to access sensitive user data through improper state management during authorization checks. The vulnerability affects iOS/iPadOS 26.4 and earlier, macOS Sequoia 15.7.5 and earlier, macOS Tahoe 26.4 and earlier, visionOS 26.4 and earlier, and watchOS 26.4 and earlier across multiple Apple devices and platforms. An attacker can exploit this by crafting a malicious application that circumvents authorization controls to read protected user information without explicit user consent. No CVSS score, EPSS probability, or active exploitation status has been disclosed by Apple, though the vulnerability spans all major Apple operating systems indicating broad platform impact.
RemediationAI
Immediate upgrade to patched versions is required across all Apple devices: upgrade to iOS/iPadOS 26.4 or later, macOS Sequoia 15.7.5 or later, macOS Tahoe 26.4 or later, visionOS 26.4 or later, and watchOS 26.4 or later. Updates can be obtained through Settings > General > Software Update on each device type. Until patching is completed, users should audit installed third-party applications and remove or disable any apps from untrusted sources that request sensitive permissions such as location, contacts, photos, or health data. IT administrators should enforce automatic OS updates via Mobile Device Management (MDM) on managed iOS/iPadOS devices and enable automatic macOS updates through System Settings > General > Software Update > Automatic Updates. For Vision Pro and Watch deployments, enable automatic updates through the companion iPhone or Mac. Additionally, review application permissions regularly (iOS: Settings > Privacy, macOS: System Settings > Privacy & Security) and disable unnecessary permissions until patches are applied. See Apple's official advisory links for detailed patch notes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in Apple's authorization and permission management framework, which enforces user data access controls across iOS, iPadOS, macOS, visionOS, and watchOS platforms as identified by CPE strings (cpe:2.3:a:apple:ios_and_ipados, cpe:2.3:a:apple:macos, cpe:2.3:a:apple:visionos, cpe:2.3:a:apple:watchos). The root cause is classified as an information disclosure issue stemming from improper state management in the authorization subsystem. The vulnerability allows applications running on these platforms to maintain or reuse valid authorization states beyond their intended scope or duration, enabling unauthorized access to sensitive user data such as contacts, location, photos, health data, or other protected resources normally gated by iOS/macOS permission prompts. This is a state-management weakness rather than a cryptographic or network protocol flaw, making it a logical authorization control bypass at the OS level.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Tahoe 26.4, visionOS 26.4, watchOS 26.4. An app may be able to access sensitive user data.
Executive ViewAI
Organizations using An authorization should be aware of moderate risk from CVE-2026-28877, a information exposure vulnerability rated CVSS 5.5. Sensitive information could be exposed to unauthorized parties. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict endpoint access, redact sensitive data in logs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
GitHub PoC
Exploit-DB