{"id":"CVE-2026-112500","kind":"vulnerability","aliases":["CVE-2026-112500"],"related":[],"title":"Apple: Hide My Email can leak the user's real address","description":"A logic issue was addressed with improved restrictions. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. The user's original email address may be leaked when using the Hide My Email feature.","summary":"A logic flaw in Apple's Hide My Email feature can expose the user's original email address to the sites or services they sign up with. Fixed in iOS 27.2, iPadOS 27.2, macOS Golden Gate 27.2 and visionOS 27.2, according to the advisory text.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple","ios","ipados","macos","other","visionos"],"not_affected_if":["hide-my-email-unused"],"how_to_check":"- unknown","fix":"- Update to iOS 27.2, iPadOS 27.2, macOS Golden Gate 27.2 or visionOS 27.2 (`27.2`)","status":"open","published_at":"2026-10-26T21:17:41+00:00","first_seen_at":"2026-10-26T21:20:26+00:00","triaged_at":"2026-10-26T21:29:47+00:00","updated_at":"2026-10-26T21:29:47+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-26T21:29:47Z","model":"claude-haiku-5-5","output":{"fix":"- Update to iOS 27.2, iPadOS 27.2, macOS Golden Gate 27.2 or visionOS 27.2 (`27.2`)","reach":"unknown","title":"Apple: Hide My Email can leak the user's real address","impact":"low","summary":"A logic flaw in Apple's Hide My Email feature can expose the user's original email address to the sites or services they sign up with. Fixed in iOS 27.2, iPadOS 27.2, macOS Golden Gate 27.2 and visionOS 27.2, according to the advisory text.","category":"other","nicknames":[],"who_cares":["apple","ios","macos","ipados","visionos"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Real email address of the user is disclosed to third parties","analyst_note":"Sources only give the NVD entry and the Apple wording; check Apple's security notes for the 27.2 release and whether the leak needs any user action.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["hide-my-email-unused"],"who_is_affected":"Individual Apple device users who use Hide My Email on the affected OS versions; the sources do not describe any enterprise or server-side exposure. Teams that run no Apple devices or do not use Hide My Email can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000574,"input_tokens":3278,"output_tokens":492,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-112500':14A,17A '-2026':13A,16A '27.2':54B,56B,60B,63B,83C,86C,90C,92C 'accord':64B 'address':11A,41B,73C,98C 'advisori':67B 'appl':1A,18B,28B 'cve':12A,15A 'email':4A,32B,40B,97C,107C 'expos':35B 'featur':33B,108C 'fix':51B,80C 'flaw':26B 'gate':59B,89C 'golden':58B,88C 'hide':2A,30B,105C 'improv':75C 'io':19B,53B,82C 'ipado':20B,55B,85C 'issu':71C,78C 'leak':6A,101C 'logic':25B,70C 'maco':21B,57B,87C 'may':99C 'origin':39B,96C 'real':10A 'restrict':76C 'servic':46B 'sign':48B 'site':44B 'text':68B 'use':103C 'user':8A,37B,94C 'visiono':23B,62B,91C","nicknames":[],"mitigations":[],"who_affected":"Individual Apple device users who use Hide My Email on the affected OS versions; the sources do not describe any enterprise or server-side exposure. Teams that run no Apple devices or do not use Hide My Email can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:17:41+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112500","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112500","severity":null,"published_at":"2026-10-26T21:17:41+00:00","modified_at":"2026-10-26T21:17:41+00:00","first_seen_at":"2026-10-26T21:20:26+00:00","fetched_at":"2026-10-26T21:20:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}