Apple Patches iMessage Flaws That Could Let Strangers Read Your Group Chats Without an Invite

Apple has fixed two iMessage flaws that could let unauthorised users join group chats and read messages, including some sent before they were added.

The vulnerabilities were addressed in security updates released on 9 November 2026, alongside fixes for separate Bluetooth and AirPlay pairing issues.

One flaw could allow a remote attacker to join a group without authorisation and receive its messages. Another could expose messages sent before a newly added user joined.

How the iMessage Flaws Could Expose Group Messages

Apple's security advisory identifies the first issue as CVE-2026-113961. It describes an authorisation vulnerability that could allow a remote attacker to join an iMessage group chat and receive its messages. Apple addressed the problem through improved validation.

The second flaw, CVE-2026-113960, concerns message history. Apple says a user added to an iMessage group may be able to access messages sent before they joined. The company fixed this by removing the vulnerable code.

Neither description establishes that an attacker successfully accessed anyone's conversations.

Apple has not said whether either vulnerability was exploited in real-world attacks, how frequently they could be triggered or whether specific users were affected.

Both Messages flaws are credited to an anonymous researcher. Apple has not disclosed the researcher's identity or provided further details about how the vulnerabilities were discovered.

The advisory lists the fixes for supported iPhones and iPads running iOS 27.2.1 and iPadOS 27.2.1.

Apple also lists corresponding fixes in its software updates for devices running older supported versions, including iOS 26.7.3 and iPadOS 26.7.3. The relevant macOS updates cover the corresponding release branches.

Separate Fixes for Bluetooth and AirPlay Pairing

The same round of updates includes fixes for separate Bluetooth-related security issues. These should not be treated as one vulnerability, as Apple's advisory describes different potential impacts.

One issue, CVE-2026-113965, could allow a malicious Bluetooth device to establish a pairing without user interaction. Another, CVE-2026-113964, could let an attacker within Bluetooth range bypass limits on pairing-code attempts and pair with a device without the owner interacting with it.

Apple also documented CVE-2026-113968, which could allow an attacker within Bluetooth range to bypass the rate limit on AirPlay pairing-code attempts. That issue concerns AirPlay pairing rather than the same direct Bluetooth pairing impact described in the other two entries.

The advisory also does not say that every nearby device could automatically connect to an iPhone, nor does it establish that these weaknesses were used to access personal data. It describes potential security impacts that Apple says its updates address.

How to Check for Apple Software Updates

Apple's 9 November security release covers iPhone 11 models and later, alongside a range of supported iPad models. The company also publishes fixes across several operating system branches, so the relevant update depends on the device and software version.

For iPhone owners, the practical step is to check Settings, select General and then Software Update to see whether an update is available. iPad users can follow the same route. Mac owners should check System Settings for available software updates.

Apple's advisory does not confirm whether either iMessage vulnerability was exploited before the fixes became available. It also does not identify any affected conversations or users.

The two Messages vulnerabilities were listed separately in Apple's security documentation, with CVE-2026-113961 covering unauthorised group-chat access and CVE-2026-113960 covering access to messages sent before a user joined.