iOS and iPadOS CVE-2026-86955

Requires a malicious or compromised app to already be installed and running on the target iOS/iPadOS device (local vector, AV:L; PR:L reflects the app's own low-privilege execution context). The app leverages an authorization state-management defect to bypass permission checks and reach sensitive user data. Limiting factors that reduce real-world risk: there is no network/remote vector, the attacker must get an app onto the device (via App Store review, enterprise/MDM distribution, or sideloading), and only versions before iOS/iPadOS 27 are affected - updating to 27 fully remediates. No user interaction is required once the app is present (UI:N).

This is a moderate-severity, locally-exploitable authorization flaw (CWE-862, Missing Authorization) in iOS/iPadOS before version 27. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) is internally consistent and credible: exploitation requires a local vector (a malicious or compromised app already present on the device, PR:L), carries low attack complexity, needs no user interaction, and yields high confidentiality impact with no integrity or availability effect - matching the description 'an app may be able to access sensitive user data.' Real-world prioritization signals are mild: no CISA KEV listing, no public POC identified, and no EPSS score was provided in the input, so there is no evidence of active exploitation or mass-scanning pressure. The practical risk is therefore scoped to a malicious-app / sideloaded-app threat model rather than remote compromise - meaningful for high-value targets and privacy-sensitive users but not a drop-everything network-exploitable emergency. Note one metadata tension: the input Tag labels this an 'Authentication Bypass,' whereas the CWE-862 classification and description describe a missing-authorization / access-control issue, not an authentication bypass - treat the tag loosely.

A user installs a seemingly benign app that, once running on the device, abuses the authorization state-management flaw to bypass access controls and read sensitive user data it should not be entitled to (e.g., private user information guarded by permission checks). Because the vector is local (AV:L) and needs no user interaction beyond having the app present, the malicious app acts autonomously after launch. No public exploit code was identified at time of analysis.