This vulnerability (CVE-2026-28877) involves an authorization flaw in Apple iOS and iPadOS that could allow an app to access sensitive user data improperly. The root cause was related to state management in the authorization process. Apple fixed the issue in iOS 18.7.9, iPadOS 18.7.9, and corresponding updates for macOS Sequoia, Sonoma, Tahoe, visionOS, and watchOS. The CVSS 3.1 base score is 5.5, reflecting a medium severity with local attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality impact.

An attacker could exploit this vulnerability to gain unauthorized access to sensitive user data on affected Apple devices. There is no impact on data integrity or availability. The vulnerability requires local access and user interaction, limiting the ease of exploitation. No known exploits are reported in the wild at this time.

Apple has released official fixes for this vulnerability in iOS 18.7.9, iPadOS 18.7.9, and related updates for other Apple operating systems. Users and administrators should apply these updates promptly to remediate the issue. Since this is not a cloud service, remediation depends on updating the affected devices. Patch status is confirmed by the vendor advisory.