CVE-2026-20682

State: PUBLISHED · Published: 2026-02-11 · Updated: 2026-04-02 · Assigner: apple

Description

A logic issue was addressed with improved state management. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3. An attacker may be able to discover a user’s deleted notes.

CWE

CWE-200 — CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected

Apple / iOS and iPadOS — v=0 <18.7.5 [affected]; v=0 <26.3 [affected]

CVSS

(none)

References

https://support.apple.com/en-us/126346
https://support.apple.com/en-us/126347

Source

cvelistV5-main/cves/2026/20xxx/CVE-2026-20682.json