A critical authorization vulnerability affecting multiple Apple operating systems allows unauthenticated applications to modify sensitive user contact data without authorization.

This is an authorization bypass vulnerability where an application can perform actions exceeding its intended permissions. The flaw stems from improper validation logic, allowing an unauthenticated application to programmatically inject or modify contact entries without user interaction.

The exploitation of this vulnerability poses a significant risk to user privacy and data integrity. By enabling unauthorized contact injection, attackers could facilitate social engineering campaigns, spam, or phishing attempts that appear legitimate to the device owner. Given the CVSS score of 9.8, this flaw is categorized as critical because it allows for high impact to confidentiality, integrity, and availability without requiring user interaction.

Immediate Action: Update all affected Apple devices to iOS/iPadOS 18.7.10 or 26.6, and macOS, visionOS, or watchOS 26.6 immediately.

Proactive Monitoring: Review application permission logs and audit contact list integrity for unexpected entries that were not explicitly added by the user.

Compensating Controls: While no direct network-level WAF can mitigate this client-side OS flaw, organizations should enforce strict mobile device management (MDM) policies to restrict the installation of unverified or untrusted applications.

Public Exploit Available: Unknown

Due to the critical nature of this vulnerability and its potential to compromise personal contact information, immediate patching across the entire Apple device ecosystem is mandatory. Administrators should prioritize the deployment of the 18.7.10 or 26.6 updates to ensure the authorization validation logic is corrected and to prevent potential abuse by malicious applications.