CVE-2025-31267

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-31267", "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "state": "PUBLISHED", "assignerShortName": "apple", "dateReserved": "2025-03-27T16:13:58.341Z", "datePublished": "2025-07-10T22:23:29.784Z", "dateUpdated": "2026-04-02T18:20:43.047Z"}, "containers": {"cna": {"problemTypes": [{"descriptions": [{"lang": "en", "description": "An attacker with physical access to an unlocked device may be able to view sensitive user information"}]}], "affected": [{"vendor": "Apple", "product": "App Store Connect", "versions": [{"version": "0", "status": "affected", "lessThan": "3.0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "An authentication issue was addressed with improved state management. This issue is fixed in App Store Connect 3.0. An attacker with physical access to an unlocked device may be able to view sensitive user information."}], "references": [{"url": "https://support.apple.com/en-us/123356"}], "providerMetadata": {"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", "dateUpdated": "2026-04-02T18:20:43.047Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-287", "lang": "en", "description": "CWE-287 Improper Authentication"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-07-15T13:44:24.610090Z", "id": "CVE-2025-31267", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-15T13:45:00.820Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-31267", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-07-15T13:44:24.610090Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287 Improper Authentication"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-15T13:44:55.984Z"}}], "cna": {"affected": [{"vendor": "Apple", "product": "App Store Connect", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "3.0", "versionType": "custom"}]}], "references": [{"url": "https://support.apple.com/en-us/123356"}], "descriptions": [{"lang": "en", "value": "An authentication issue was addressed with improved state management. This issue is fixed in App Store Connect 3.0. An attacker with physical access to an unlocked device may be able to view sensitive user information."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "An attacker with physical access to an unlocked device may be able to view sensitive user information"}]}], "providerMetadata": {"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", "dateUpdated": "2025-07-10T22:23:29.784Z"}}}, "cveMetadata": {"cveId": "CVE-2025-31267", "state": "PUBLISHED", "dateUpdated": "2025-07-15T13:45:00.820Z", "dateReserved": "2025-03-27T16:13:58.341Z", "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "datePublished": "2025-07-10T22:23:29.784Z", "assignerShortName": "apple"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "App Store Connect", "vendor": "Apple", "versions": [{"lessThan": "3.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "product-security@apple.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apple:app_store_connect:*:*:*:*:*:*:*:*", "matchCriteriaId": "6656D3E8-79F4-4308-B649-48A828BF8AFC", "versionEndExcluding": "3.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An authentication issue was addressed with improved state management. This issue is fixed in App Store Connect 3.0. An attacker with physical access to an unlocked device may be able to view sensitive user information."}, {"lang": "es", "value": "Se solucion\u00f3 un problema de autenticaci\u00f3n mejorando la gesti\u00f3n del estado. Este problema se solucion\u00f3 en App Store Connect 3.0. Un atacante con acceso f\u00edsico a un dispositivo desbloqueado podr\u00eda acceder a informaci\u00f3n confidencial del usuario."}], "id": "CVE-2025-31267", "lastModified": "2026-06-17T09:10:11.810", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-31267", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-07-15T13:44:24.610090Z", "version": "2.0.3"}}]}, "published": "2025-07-10T23:15:27.800", "references": [{"source": "product-security@apple.com", "tags": ["Vendor Advisory"], "url": "https://support.apple.com/en-us/123356"}], "sourceIdentifier": "product-security@apple.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-28T01:08:50.503654+00:00", "value": {"mitigation_remediation": ["Upgrade App\u00a0Store\u00a0Connect to version\u00a03.0 or later to receive the authentication state management fix.", "Ensure that devices are locked and physically secured when not in use to prevent unauthorized access to authenticated sessions.", "Enforce device management policies that automatically lock screens and restrict physical access to authorized personnel only."], "summary": {"action": "Apply patch", "impact": "Sensitive data exposure through authentication state failure on an unlocked device"}, "threat_synthesis": {"affected_systems": "Apple\u00a0App\u00a0Store\u00a0Connect. Any version prior to 3.0 is vulnerable; the fix is delivered in App\u00a0Store\u00a0Connect\u00a03.0 and later.", "description_and_impact": "An authentication flaw in App Store\u00a0Connect, fixed in version\u00a03.0, allows an attacker who gains physical access to a device that is already unlocked to view sensitive user information by exploiting improper state management of authenticated sessions.", "risk_and_exploitability": "The vulnerability carries a CVSS score of\u00a04.6, indicating moderate risk. The EPSS score is below\u00a01\u202f%, meaning exploitation is expected to be rare, and the issue is not listed in the CISA KEV catalog. The likely attack path requires physical access to an unlocked device, after which an attacker can read protected data that should otherwise be shielded by authentication state checks."}}}}, "created": "2026-04-28T01:15:15.672648+00:00", "title": "Authentication State Mismanagement Allows Physical Access to Sensitive User Information on App\u00a0Store\u00a0Connect", "updated": "2026-04-28T01:15:15.672664+00:00", "vendors": []}