CVE-2024-23255: 
macOS vulnerability analysis and mitigation

An authentication vulnerability (CVE-2024-23255) was discovered affecting Apple's Photos application in macOS Sonoma, iOS 17.4, and iPadOS 17.4. The vulnerability allows unauthorized access to photos stored in the Hidden Photos Album without proper authentication. This security issue was reported by security researcher Harsh Tyagi and was addressed by Apple in their March 2024 security updates (Apple Advisory).

The vulnerability stems from an authentication issue in the Photos application's state management system. Apple addressed this security flaw by implementing improved state management mechanisms. The vulnerability has been assigned a CVSS v3.1 base score of 2.4 (LOW) by NIST with vector string CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, though CISA-ADP assessed it with a higher CVSS score of 9.1 (CRITICAL) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (NVD).

The vulnerability allows unauthorized users to view photos stored in the Hidden Photos Album, potentially exposing private and sensitive images that users specifically chose to hide from normal access. This represents a significant privacy breach for users who rely on the Hidden Photos Album feature to protect sensitive content (Apple Advisory).

The vulnerability requires physical access to the device to be exploited. No active exploits have been reported in the wild, and Apple has addressed the issue through security updates in macOS Sonoma 14.4, iOS 17.4, and iPadOS 17.4 (Apple Advisory).

Apple has released patches to address this vulnerability in macOS Sonoma 14.4, iOS 17.4, and iPadOS 17.4. Users are strongly advised to update their devices to these versions or later to protect against unauthorized access to their Hidden Photos Album. No alternative workarounds have been published (Apple Advisory).