A significant vulnerability in Apple's Hide My Email service, a core privacy feature for iCloud subscribers, can allow attackers to uncover a user's real email address, according to security researchers.