External risk intelligence

Apple OS Contact App Authorization Bypass

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-64746

This vulnerability involves an authorization issue within the local contact management functionality of Apple operating systems. It is specific to client-side application behavior and local data modification, not a network-accessible service, edge gateway, or public-facing internet endpoint.

Apple Ipados

before 26.626.0 to before 26.6

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical security vulnerability in Apple operating systems that could allow an application to add contacts without user consent. The issue has been fixed in the latest versions of iOS, iPadOS, macOS, visionOS, and watchOS. The primary concern is to confirm if your organization's devices and relevant applications are updated to mitigate this risk.

Apps could add contacts without permission.
Protects user privacy and unauthorized data access.
Confirm device and app updates are deployed.

Attack Path

How an attacker could exploit the issue

An attacker could potentially exploit this vulnerability by tricking a user into interacting with a malicious app. If successful, the app could then add contacts to the user's address book without their explicit permission, potentially leading to unauthorized data access or further social engineering attacks.

Malicious app exposure required.
App interaction triggers unauthorized contact addition.
Contact data exposure and manipulation risk.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an app to add contacts to a user's contact list without their explicit authorization. This could occur when an app has the capability to interact with the contacts database and bypass normal authorization checks.

Unauthorized contact additions.
Apps could add contacts without permission.
User contact data could be modified.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts Apple operating systems, meaning platform or infrastructure teams supporting these devices are likely responsible for remediation. The first practical step is to identify all affected devices, confirm their business criticality and network exposure, and then assign ownership for the fix.

Platform and infrastructure teams own resolution.
Verify affected device inventory and exposure.
Plan and execute the upgrade to the fixed versions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the software affected by CVE-2026-64746?

This vulnerability affects the contact management systems integrated into Apple's primary operating platforms, including iOS, iPadOS, macOS, visionOS, and watchOS. These systems are used to manage personal and professional address books across Apple devices. The issue specifically resides in how these operating systems handle authorization requests when applications attempt to modify or add entries to a user's contact list.

What does this authorization issue mean in plain English?

This is a CWE-862 weakness, which is a Missing Authorization vulnerability. It means that the operating system fails to properly verify if an application has been granted explicit permission by the user before performing a sensitive action. In this specific case, the system allows an app to bypass normal security checks and add new contacts to the address book, even if the user never authorized that app to access or modify their contact data.

How does an attacker trigger this vulnerability?

The vulnerability is triggered when a user interacts with a malicious application that exploits this authorization gap. It does not occur automatically through background processes or network activity alone. A user must actively run or engage with the unauthorized software for the contact injection to succeed. Simply having the app installed without interacting with it is generally insufficient to trigger the underlying flaw.

Do I need to worry if my Apple devices are not internet-facing?

According to Halo Surface Signal, this vulnerability is considered very unlikely to be remotely triggered because it involves local contact management rather than a network-accessible service. Even if your devices are internal and not directly exposed to the internet, you should still evaluate the risk based on the apps allowed on your systems, as the issue relies on client-side application behavior.

What is the first step to fix this issue?

The most effective way to address this vulnerability is to update your Apple devices to version 26.6 or later of their respective operating systems. Since this fix is built directly into the OS, updating ensures that the validation logic for contact permissions is correctly enforced. Organizations should prioritize inventorying their Apple devices and deploying these official updates to all impacted hardware.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.