CVE-2024-23290 is a logic issue in Apple iOS and iPadOS that allowed an app to access sensitive user data due to insufficient restrictions. Apple addressed this vulnerability by improving state management and applying stricter access controls. The fix was included in iOS 17.4 and iPadOS 17.4 releases. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity), with attack vector local, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability at a low level. The issue is part of a broader set of security updates released by Apple on March 5, 2024, which also address multiple other vulnerabilities across Apple platforms.

An app with local access and low privileges could exploit this logic flaw to read sensitive user data that should be protected. The impact includes potential unauthorized disclosure of user-sensitive information, with low impacts on integrity and availability. There are no reports of active exploitation in the wild. The vulnerability could compromise user privacy if exploited.

Apple has released official fixes for this vulnerability in iOS 17.4 and iPadOS 17.4. Users and administrators should update affected devices to these versions or later to remediate the issue. No additional mitigation steps are required beyond applying the official update.