CVE-2026-20648

Analyzed Analyzed - Analysis Complete

Unauthorized Notification Access Vulnerability in macOS Tahoe

Publication date: 2026-02-11

Last updated on: 2026-02-13

Assigner: Apple Inc.

Description

A privacy issue was addressed by moving sensitive data to a protected location. This issue is fixed in macOS Tahoe 26.3. A malicious app may be able to access notifications from other iCloud devices.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-02-11

Last Modified

2026-02-13

Generated

2026-07-06

AI Q&A

2026-02-12

EPSS Evaluated

2026-07-05

NVD

CVE-2026-20648

EUVD

EUVD-2026-6713

Affected Vendors & Products

Vendor	Product	Version / Range
apple	macos	to 26.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability is a privacy issue in macOS Tahoe where a malicious application may be able to access notifications from other iCloud devices. The issue was addressed by moving sensitive data to a protected location to prevent unauthorized access.

Impact Analysis

If exploited, this vulnerability could allow a malicious app to access notifications from other iCloud devices, potentially exposing sensitive information that appears in those notifications.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, update your system to macOS Tahoe 26.3 or later, where the issue has been fixed by moving sensitive data to a protected location.

Hi! I’m here to help you understand CVE-2026-20648. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70