CVE-2022-26773: apple itunes Improper Authorization
Modified
Published 26-05-2022Last modified 30-05-2025
Vulnerability summary
CVE-2022-26773 is a high (CVSS 7.1) Improper Authorization vulnerability in apple itunes. EPSS estimates a 0.58% chance of exploitation in the next 30 days, higher than 47.1% of scored vulnerabilities.
CVSS score
7.1/10
010
High · v3.1 (CVE.org)EPSS score
0.58%
0%100%
Low · +0.02 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Timeline
- 26-05-2022PublishedVulnerability first disclosed.
- 30-05-2025Last modifiedVulnerability information updated.
Description
A logic issue was addressed with improved state management. This issue is fixed in iTunes 12.12.4 for Windows. An application may be able to delete files for which it does not have permission.
CVSS metrics
3 scores · 2 sources · 2 versionsHigh 7.1Preferred score · CVE.org (CNA)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:HSourcesAll 2 agree
- NVDNIST7.1HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Medium 5.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:N/I:P/A:PSourcesSingle source
EPSS trend
Probability
0.58%
Chance of exploitation in the next 30 days
Percentile
47%
Versus all other CVEs
30-day change
Increase +0.02 pp
From 0.56% on 22-09-2026
22-09-202622-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Apple2 products
- itunes< 12.12.4
- itunes for windows≥ unspecified, < 12.12
1 vendor · 2 products