CVE-2026-43801 is a vulnerability in Apple iOS and iPadOS where an app may be able to access sensitive user data due to insufficient access checks. Apple has fixed this issue by implementing improved checks in iOS 26.6, iPadOS 26.6, and other related Apple operating systems. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information). The CVSS v3.1 base score is 5.5, reflecting a medium severity with local attack vector, low attack complexity, no privileges required, and user interaction needed. The vulnerability does not impact integrity or availability, only confidentiality.

An attacker controlling a malicious app could potentially access sensitive user data on affected Apple devices. This exposure could lead to privacy violations but does not affect system integrity or availability. The vulnerability requires local access and user interaction to exploit.

This vulnerability has been fixed by Apple in iOS 26.6 and iPadOS 26.6, among other OS versions. Users and administrators should update affected devices to these versions or later to remediate the issue. Since the fix is available, applying the official update is the recommended mitigation. No additional mitigations are indicated by the vendor.