This vulnerability involves a permissions issue in Apple iOS and iPadOS that could allow an app to bypass certain Privacy preferences. Apple addressed the issue by adding additional restrictions in iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5, and watchOS 26.5. The CVSS 3.1 vector indicates the attack requires local access with low complexity and low privileges, no user interaction, and impacts confidentiality but not integrity or availability. The weakness is categorized under CWE-284 (Improper Access Control). No known exploits have been reported. The vendor has released updates that fix the issue.

An app with limited privileges may bypass user-configured Privacy preferences, potentially exposing sensitive data. The impact is on confidentiality only, with no effect on integrity or availability. The vulnerability requires local access and low privileges, which limits the attack surface. No active exploitation has been observed.

Apple has fixed this vulnerability in iOS 26.5, iPadOS 26.5, and related OS versions. Users and administrators should update affected devices to these versions or later to remediate the issue. Since the vendor advisory confirms the fix, applying the official update is the recommended mitigation. No additional actions are indicated.