CVE-2025-31255CWE-285

CVE-2025-31255

Critical · published September 16, 2025

CVSS v3.1
9.8
EPSS
2%
Percentile
75.2
In the wild
Unconfirmed
What it is

🚨 A sneaky authorization flaw could let apps access your sensitive data on multiple Apple devices! 🔥 Think of it like a poorly secured hotel room where anyone with a valid keycard can walk in and rummage through your personal belongings without a second thought. This vulnerability leaves your data exposed just like that unlocked door! An attacker could exploit this flaw to gain unauthorized access to sensitive user data, putting your personal information and privacy at risk. Imagine the chaos if someone could freely browse through your private messages, photos, or even financial data! The consequences could be absolutely devastating!

Put simply

Think of it like a poorly secured hotel room where anyone with a valid keycard can walk in and rummage through your personal belongings without a second thought. This vulnerability leaves your data exposed just like that unlocked door! This vulnerability arises from inadequate state management during authorization, allowing apps to access data they shouldn't have permission to view. It’s a classic case of bad access control that needs immediate attention.

What to do

An attacker could exploit this flaw to gain unauthorized access to sensitive user data, putting your personal information and privacy at risk. Imagine the chaos if someone could freely browse through your private messages, photos, or even financial data! The consequences could be absolutely devastating! Update to iOS 26 and iPadOS 26, macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26, tvOS 26, or watchOS 26 right away to close this security hole. Regularly check for updates and ensure all apps are compliant with the latest security standards! You've got this! Stay vigilant, update your devices, and keep that data locked down tight! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01571 · 75.2th percentile
Weakness
CWE-285 · Improper Authorization
Published
2025-09-16T03:15Z
Affected products (6)
ProductVersionsFixed in
apple/ipados< 26.026.0
apple/iphone_os< 26.026.0
apple/macos≥ 14.0, < 14.814.8
apple/macos≥ 15.0, < 15.715.7
apple/tvos< 26.026.0
apple/watchos< 26.026.0
References (11)
EPSS history
Timeline
  • 15 SEP 22:34Z
    An authorization issue was addressed with improved state management
    cvelistv5