The issue was addressed with additional permissions checks. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, macOS Ventura 13.6.5. A shortcut may be able to use sensitive data with certain actions without prompting the user.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Ipados | Apple | 17.0 (excluding) | 17.3 (excluding) |
| Iphone_os | Apple | 17.0 (excluding) | 17.3 (excluding) |
| Macos | Apple | * | 14.3 (excluding) |
References
- https://support.apple.com/en-us/120304
- https://support.apple.com/en-us/120309
- https://support.apple.com/en-us/120880
- https://support.apple.com/en-us/120886
- http://seclists.org/fulldisclosure/2024/Jan/33
- http://seclists.org/fulldisclosure/2024/Jan/36
- http://seclists.org/fulldisclosure/2024/Mar/22
- https://support.apple.com/en-us/HT214059
- https://support.apple.com/en-us/HT214061
- https://support.apple.com/kb/HT214061
- https://support.apple.com/kb/HT214082
- https://support.apple.com/kb/HT214085