Skip to content
Log inStart free trial

CVE-2025-31201

This issue was addressed by removing the vulnerable code.

Critical Known exploited
Severity
9.8 / 10
Critical · CVSS 3.1
Exploit chance (EPSS)
13.97%
Chance of exploitation in the next 30 days. Higher than 96.55% of scored vulnerabilities.
Known exploited
Yes
In CISA's catalog since Apr 17, 2025
Weakness
CWE-1220 Insufficient Granularity of Access Control
Fix
None yet
No fixed version published
Exploited in the wild. Apple Multiple Products Arbitrary Read and Write Vulnerability (Apple Multiple Products). Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Due for U.S. federal agencies by May 8, 2025.

Description

This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS.

How to fix

No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.

Severity breakdown

CVSS 3.1 9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Weakness

CWE-1220: Insufficient Granularity of Access Control

The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.

How to prevent it
  • Architecture and Design, Implementation, Testing: Access-control-policy protections must be reviewed for design inconsistency and common weaknesses. Access-control-policy definition and programming flow must be tested in pre-silicon, post-silicon testing.

References

Advisories

Exploits and evidence

Other links

Timeline

  1. Published
  2. Added to CISA's Known Exploited Vulnerabilities catalog
  3. Remediation due for U.S. federal agencies
  4. Last updated by the source
  5. Latest EPSS score
AdvisorySeverityWhy it's related
DRUPAL-CONTRIB-2026-167
The Webform module enables site builders to create forms and collect submissions.
Medium Same weakness, CWE-1220
EEF-CVE-2026-86338
Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracle
Not rated yet Same weakness, CWE-1220
EEF-CVE-2026-78216
AshLua eval read operations can read field-policy-protected fields via aggregates
Not rated yet Same weakness, CWE-1220
EEF-CVE-2026-78230
AshAi aggregate tool can read field-policy-protected fields
Not rated yet Same weakness, CWE-1220
CVE-2026-56155
Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.
High Known exploited Same weakness, CWE-1220
GHSA-6g26-7cx5-mrrg
Keycloak: Information disclosure due to user profile permission bypass
Low Same weakness, CWE-1220
GHSA-8c7q-86fq-vvmh
MLflow allows unauthorized access to multipart upload endpoints when the `--serve-artifacts` mode is enabled
Critical Same weakness, CWE-1220
GHSA-933f-rg6j-f46p
Keycloak Account Resources user lookup contains broken access control
Medium Same weakness, CWE-1220
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor