CVE-2026-20682

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-20682
A logic issue was addressed with improved state management. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3. An attacker may be able to discover a user’s deleted notes.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://support.apple.com/en-us/126346 Release Notes Vendor Advisory
https://support.apple.com/en-us/126347 Release Notes Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
History

25 Mar 2026, 16:16

Type Values Removed Values Added
Summary
  • (es) Se abordó un problema de lógica con una gestión de estado mejorada. Este problema está solucionado en iOS 26.3 y iPadOS 26.3, iOS 18.7.5 y iPadOS 18.7.5. Un atacante podría descubrir las notas eliminadas de un usuario.
Summary (en) A logic issue was addressed with improved state management. This issue is fixed in iOS 26.3 and iPadOS 26.3, iOS 18.7.5 and iPadOS 18.7.5. An attacker may be able to discover a user’s deleted notes. (en) A logic issue was addressed with improved state management. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3. An attacker may be able to discover a user’s deleted notes.

17 Feb 2026, 16:20

Type Values Removed Values Added
CWE CWE-200

12 Feb 2026, 18:41

Type Values Removed Values Added
References () https://support.apple.com/en-us/126346 - () https://support.apple.com/en-us/126346 - Release Notes, Vendor Advisory
References () https://support.apple.com/en-us/126347 - () https://support.apple.com/en-us/126347 - Release Notes, Vendor Advisory
CPE cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
First Time Apple ipados
Apple
Apple iphone Os
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.3
CWE NVD-CWE-noinfo

11 Feb 2026, 23:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-11 23:16

Updated : 2026-03-25 16:16

NVD link : CVE-2026-20682

Mitre link : CVE-2026-20682

CVE.ORG link : CVE-2026-20682

JSON object : View

Products Affected

apple

  • ipados
  • iphone_os
CWE
NVD-CWE-noinfo CWE-200

Exposure of Sensitive Information to an Unauthorized Actor