CVE-2026-113914

Published: Oct 26, 2026Modified: Nov 2, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. An app may be able to access sensitive user data.

Affected (4)

Products: Apple: Ipados, Iphone Os

Apple

2 products

Ipados

Iphone Os

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Apple Ipados	version < 26.7.2
Apple Ipados	27.0 ≤ version < 27.2
Apple Iphone Os	version < 26.7.2
Apple Iphone Os	27.0 ≤ version < 27.2

Related CWEs

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (2)

https://support.apple.com/en-us/149227

Source: product-security@apple.com

Release NotesVendor Advisory

https://support.apple.com/en-us/149230

Source: product-security@apple.com

Release NotesVendor Advisory

Timeline

No history available yet.