CVE-2023-40393 is a high severity (CVSS 7.5) authentication flaw in Apple's Photos. Photos in the Hidden Photos Album may be viewed without authentication. Apple fixed it in iOS 17, iPadOS 17 and macOS Sonoma 14, so update devices below those releases.
What's affected
Apple's description says an authentication issue was addressed with improved state management. The fixed releases are iOS 17, iPadOS 17 and macOS Sonoma 14.
The NVD record scores the flaw 7.5 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, which is a confidentiality only impact. The record's product list names macOS, while its description also names iOS and iPadOS. Apple's own page for macOS Sonoma 14, which we read, lists the entry as added on 22 December 2023, well after the 26 September 2023 release.
The weakness class is CWE-306 (missing authentication for a critical function). Apple does not publish scores for its entries, so the severity comes from NVD.
How to check if you're exposed
On a Mac, read the installed version and look for pending updates:
sw_vers
softwareupdate --list
On an iPhone or iPad, open Settings, then General, then About, and read the iOS or iPadOS version. Apple Watch and Apple TV show their version in Settings under General and About as well.
For a managed fleet, use the OS version report in your mobile device management tool and filter for devices below the fixed release.
Anything on iOS 16 or macOS Ventura and earlier is below the fixed release named in the record and in Apple's note. Devices that cannot run iOS 17 or macOS Sonoma 14 should be checked against Apple's security notes for the latest release that supports them.
What to do now
- Check which iPhones, iPads and Macs your team uses, including personal devices that hold company photos.
- Update to iOS 17, iPadOS 17 or macOS Sonoma 14 or later.
- For devices that cannot take that release, read Apple's security notes for the newest release they support, and consider whether they should hold sensitive photos.
- Remind staff that the Hidden album hides photos from the main view and should not be the only protection for sensitive images.
- Add an OS version rule to your device compliance policy.
Why it matters
The bug is about state. The Photos app was meant to ask for authentication before showing the Hidden album and, in some state, did not. Apple's wording, improved state management, points to the app losing track of whether the user had been authenticated.
This is not a remote code execution bug. The score is high because the vector in the record treats it as network reachable with no privileges and no interaction. In practice the exposure is the privacy of hidden photos, which matters most on staff devices that hold sensitive images.
Quick check
Does this expose all my photos?
The advisory text is about the Hidden Photos Album being viewable without authentication. It does not say the rest of the library is affected.
Is it exploited in the wild?
The record's KEV flag is false, and Apple's note does not say it is exploited.
Sources
Last reviewed: 19 October 2026.
