CVE-2024-40805: Apple iPadOS Auth Bypass Vulnerability

CVE-2024-40805 Overview

CVE-2024-40805 is a permissions vulnerability in multiple Apple operating systems that allows an application to bypass Privacy preferences. Apple addressed the issue with additional restrictions in iOS 17.6, iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, and watchOS 10.6. The flaw maps to [CWE-276] (Incorrect Default Permissions) and [CWE-281] (Improper Preservation of Permissions).

Exploitation requires local access and user interaction, but a successful bypass exposes user data protected by Apple's Transparency, Consent, and Control (TCC) framework. This weakens the privacy boundaries that gate access to sensitive resources such as location, camera, microphone, and personal folders.

Critical Impact
A malicious application can bypass Privacy preferences and access resources normally protected by user consent controls.

Affected Products

Apple iOS and iPadOS prior to 17.6
Apple macOS Sonoma prior to 14.6
Apple tvOS prior to 17.6 and watchOS prior to 10.6

Discovery Timeline

2024-07-29 - CVE-2024-40805 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-40805

Vulnerability Analysis

The vulnerability stems from insufficient permission enforcement in the components that mediate access to privacy-controlled resources. Apple's advisory categorizes the flaw as a permissions issue and states it was resolved by adding restrictions. An application running on a vulnerable device can reach data or capabilities that should require explicit user consent via Privacy preferences.

The attack surface is local to the device. An adversary must deliver and run an application on the target system, and some form of user interaction is required. Once running, the application can escape the intended TCC boundary and access protected user data or subsystems without prompting for consent.

Apple's security advisories covering iOS 17.6, iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, and watchOS 10.6 confirm the fix path across the affected platforms. See Apple Support HT214117, HT214119, HT214122, and HT214124.

Root Cause

The root cause is improper preservation of permissions ([CWE-281]) combined with incorrect default permissions ([CWE-276]) in a component that governs Privacy preference enforcement. The affected code path did not consistently apply the restrictions that Privacy preferences imply, letting an application reach protected resources through an unintended pathway.

Attack Vector

The attacker installs or convinces a user to run a crafted application on a vulnerable Apple device. The application then triggers the code path that fails to enforce Privacy preferences, gaining access to resources it should not have. There is no network vector; exploitation is local and requires user interaction, such as launching the application.

No verified proof-of-concept code is published. Public discussion appears in the Full Disclosure mailing list posts on July 16, 18, 21, and 22, 2024 (seclists.org Full Disclosure archive).

Detection Methods for CVE-2024-40805

Indicators of Compromise

Applications accessing TCC-protected resources (Contacts, Photos, Location, Camera, Microphone, Full Disk Access) without a corresponding consent prompt in the user session
Unexpected reads of ~/Library/Application Support/, ~/Documents/, or other user data by unsigned or newly installed applications
Applications on iOS, iPadOS, tvOS, or watchOS installed outside expected distribution channels prior to the 17.6 / 10.6 update

Detection Strategies

Inventory endpoints and confirm OS build strings against fixed versions: iOS 17.6, iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, watchOS 10.6
On macOS, review TCC.db access patterns and unified logs (log show --predicate 'subsystem == "com.apple.TCC"') for grants issued without a user prompt
Correlate application launch events with subsequent access to sensitive directories or hardware to identify silent privacy bypasses

Monitoring Recommendations

Alert on any new application performing first access to Location, Camera, Microphone, or Full Disk Access resources shortly after install
Track code signature and notarization status of processes reading TCC-protected paths on macOS
Feed endpoint telemetry into a centralized data lake and retain TCC and process-execution events long enough to hunt retroactively once patches are deployed

How to Mitigate CVE-2024-40805

Immediate Actions Required

Update all Apple devices to iOS 17.6, iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, or watchOS 10.6 or later
Audit installed applications on macOS endpoints and remove untrusted or unsigned software
Review Privacy preference grants under System Settings > Privacy & Security and revoke access for applications that should not hold it

Patch Information

Apple released fixes across all affected platforms on July 29, 2024. Consult Apple Support documents 120909, 120911, 120914, and 120916 as well as the corresponding HT214117, HT214119, HT214122, and HT214124 articles for platform-specific build numbers.

Workarounds

Restrict application installation to vetted sources through MDM policy and Gatekeeper enforcement on macOS
Deploy managed configuration profiles that limit which applications may request Privacy permissions
Where patching is delayed, remove unnecessary third-party applications and disable sideloading capabilities

bash

# Verify macOS build meets or exceeds Sonoma 14.6
sw_vers -productVersion

# List applications with TCC entries on macOS (requires Full Disk Access)
sudo sqlite3 "/Library/Application Support/com.apple.TCC/TCC.db" \
  "SELECT client, service, auth_value FROM access;"

# Force MDM-managed devices to install available updates (example: jamf)
sudo jamf policy -event install-os-updates