Product:
iOS and iPadOS
Summary
An authorization issue was addressed with improved state management. This issue allows an app to potentially access sensitive user data. The problem has been fixed in the latest versions of iOS and iPadOS.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.5 | CVE-2026-20678 |
Exploitation
To exploit this vulnerability, an attacker would need to have local access to the device. By leveraging the authorization issue, the attacker could manipulate the app’s state management to gain unauthorized access to sensitive user data without requiring elevated privileges or user interaction.
Affected Products
- iOS 26.3 – Fixed the authorization issue that allowed access to sensitive user data.
- iPadOS 26.3 – Addressed the same vulnerability as in iOS.
- iOS 18.7.5 – Resolved the issue for this version as well.
- iPadOS 18.7.5 – Similar fix applied to this version.
Mitigation
Users are advised to update their devices to the latest versions of iOS and iPadOS to mitigate the risk associated with this vulnerability. Regularly updating software helps ensure that security issues are addressed promptly.