CVE-2024-23204 affects Apple iOS, iPadOS, and watchOS platforms, where a shortcut may be able to access sensitive data using certain actions without prompting the user for permission. This behavior violates expected user consent mechanisms for sensitive data access. The vulnerability was mitigated by Apple through the implementation of additional permissions checks in the affected operating systems. The fix is included in iOS 16.7.6, iPadOS 16.7.6, iOS 17.3, iPadOS 17.3, macOS Monterey 12.7.4, macOS Sonoma 14.3, macOS Ventura 13.6.5, and watchOS 10.3. The CVSS v3.1 base score is 7.5, indicating a high severity vulnerability with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality impact but no integrity or availability impact.

An attacker leveraging this vulnerability could cause a shortcut to access sensitive user data without the user being prompted for permission. This could lead to unauthorized disclosure of sensitive information. The vulnerability does not impact integrity or availability but has a high confidentiality impact. There are no known exploits in the wild at this time.

Apple has released official patches that address this vulnerability by adding additional permissions checks. Users and administrators should update affected Apple devices to iOS 16.7.6, iPadOS 16.7.6, iOS 17.3, iPadOS 17.3, macOS Monterey 12.7.4, macOS Sonoma 14.3, macOS Ventura 13.6.5, and watchOS 10.3 or later to remediate this issue. Applying these updates will ensure the vulnerability is fixed and no further action is required.