{"id":"CVE-2026-28850","kind":"vulnerability","aliases":["CVE-2026-28850"],"related":[],"title":"visionOS: authorization flaw lets an app reach sensitive user data","description":"An authorization issue was addressed with improved state management. This issue is fixed in visionOS 27. An app may be able to access sensitive user data.","summary":"Apple's visionOS has an authorization flaw that was fixed by improved state management in visionOS 27. A malicious or compromised app may be able to read sensitive user data it should not reach.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple-vision-pro","infrastructure","mobile","visionos"],"not_affected_if":["visionos-27-or-later"],"how_to_check":"- Check the installed visionOS version in Settings > General > About on the headset\n- unknown for any further detail the sources do not give","fix":"- Update visionOS to `27` or later\n- unknown for any interim mitigation","status":"open","published_at":"2026-10-20T01:17:11+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-25T04:12:43+00:00","updated_at":"2026-10-25T04:12:43+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T04:12:43Z","model":"claude-haiku-5-5","output":{"fix":"- Update visionOS to `27` or later\n- unknown for any interim mitigation","reach":"local","title":"visionOS: authorization flaw lets an app reach sensitive user data","impact":"medium","summary":"Apple's visionOS has an authorization flaw that was fixed by improved state management in visionOS 27. A malicious or compromised app may be able to read sensitive user data it should not reach.","category":"infrastructure","nicknames":[],"who_cares":["visionos","apple-vision-pro","mobile"],"confidence":0.5,"needs_auth":"unknown","worst_case":"an app reads sensitive user data it should not access","analyst_note":"Check Apple's visionOS 27 security notes for the affected component and whether a malicious app needs any user permission first.","how_to_check":"- Check the installed visionOS version in Settings > General > About on the headset\n- unknown for any further detail the sources do not give","needs_analyst":true,"not_affected_if":["visionos-27-or-later"],"who_is_affected":"Owners of Apple Vision Pro devices running a visionOS release earlier than 27 are exposed to a local app reaching sensitive user data. The sources do not say which apps or data types are involved, and nothing here applies to servers or hosted applications. Teams that only ship software to other platforms can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00057,"input_tokens":3240,"output_tokens":491,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-28850':13A,16A '27':40B,73C 'abl':48B,78C 'access':80C 'address':62C 'app':6A,45B,75C 'appl':18B,24B 'apple-vision-pro':17B 'author':2A,29B,59C 'compromis':44B 'cve':11A,14A 'data':10A,53B,83C 'fix':33B,70C 'flaw':3A,30B 'improv':35B,64C 'infrastructur':21B 'issu':60C,68C 'let':4A 'malici':42B 'manag':37B,66C 'may':46B,76C 'mobil':22B 'pro':20B 'reach':7A,57B 'read':50B 'sensit':8A,51B,81C 'state':36B,65C 'user':9A,52B,82C 'vision':19B 'visiono':1A,23B,26B,39B,72C","nicknames":[],"mitigations":[],"who_affected":"Owners of Apple Vision Pro devices running a visionOS release earlier than 27 are exposed to a local app reaching sensitive user data. The sources do not say which apps or data types are involved, and nothing here applies to servers or hosted applications. Teams that only ship software to other platforms can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T01:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-28850","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28850","severity":null,"published_at":"2026-10-20T01:17:11+00:00","modified_at":"2026-10-20T15:17:29+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}