{"id":"CVE-2026-112681","kind":"vulnerability","aliases":["CVE-2026-112681"],"related":[],"title":"Apple iOS and iPadOS: missing entitlement checks let apps fingerprint users","description":"This issue was addressed with additional entitlement checks. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. An app may be able to fingerprint the user.","summary":"Apple fixed a flaw in iOS and iPadOS where an app could fingerprint the user through missing entitlement checks. The sources do not describe the exact data exposed or the attack path beyond that.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ios","ipados","mobile-fleet","other"],"not_affected_if":["already-updated"],"how_to_check":"- Check the device OS version in Settings > General > About; the sources do not give a command.\n- unknown","fix":"- Update iOS and iPadOS to `26.7.2` or later on the 26 line, or `27.2` or later on the 27 line.","status":"open","published_at":"2026-10-26T21:18:02+00:00","first_seen_at":"2026-10-26T21:20:30+00:00","triaged_at":"2026-10-26T21:23:33+00:00","updated_at":"2026-10-26T21:23:33+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-26T21:23:33Z","model":"claude-haiku-5-5","output":{"fix":"- Update iOS and iPadOS to `26.7.2` or later on the 26 line, or `27.2` or later on the 27 line.","reach":"local","title":"Apple iOS and iPadOS: missing entitlement checks let apps fingerprint users","impact":"low","summary":"Apple fixed a flaw in iOS and iPadOS where an app could fingerprint the user through missing entitlement checks. The sources do not describe the exact data exposed or the attack path beyond that.","category":"other","nicknames":[],"who_cares":["ios","ipados","mobile-fleet"],"confidence":0.5,"needs_auth":"unknown","worst_case":"A installed app learns identifying details about the device or user","analyst_note":"Confirm the exact fingerprinting data and whether a non-app vector exists, using the Apple security advisory for iOS 26.7.2 and 27.2 and the NVD entry.","how_to_check":"- Check the device OS version in Settings > General > About; the sources do not give a command.\n- unknown","needs_analyst":true,"not_affected_if":["already-updated"],"who_is_affected":"Users and fleets running iOS or iPadOS builds older than the fixed versions. The sources do not say which apps or configurations are needed to exploit it, so no narrower group can be named.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000569,"input_tokens":3269,"output_tokens":484,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-112681':14A,17A '-2026':13A,16A '26.7.2':70C,73C '27.2':75C,78C 'abl':83C 'addit':61C 'address':59C 'app':9A,33B,80C 'appl':1A,23B 'attack':53B 'beyond':55B 'check':7A,41B,63C 'could':34B 'cve':12A,15A 'data':49B 'describ':46B 'entitl':6A,40B,62C 'exact':48B 'expos':50B 'fingerprint':10A,35B,85C 'fix':24B,67C 'flaw':26B 'fleet':22B 'io':2A,18B,28B,69C,74C 'ipado':4A,19B,30B,72C,77C 'issu':57C,65C 'let':8A 'may':81C 'miss':5A,39B 'mobil':21B 'mobile-fleet':20B 'path':54B 'sourc':43B 'user':11A,37B,87C","nicknames":[],"mitigations":[],"who_affected":"Users and fleets running iOS or iPadOS builds older than the fixed versions. The sources do not say which apps or configurations are needed to exploit it, so no narrower group can be named.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:18:02+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112681","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112681","severity":null,"published_at":"2026-10-26T21:18:02+00:00","modified_at":"2026-10-26T21:18:02+00:00","first_seen_at":"2026-10-26T21:20:30+00:00","fetched_at":"2026-10-26T21:20:30+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}