CVE-2025-43184
CRITICALCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2Description
This issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. A shortcut may be able to bypass sensitive Shortcuts app settings.
Analysis
Authentication bypass in macOS Shortcuts allows malicious shortcuts to circumvent sensitive app settings without user consent across macOS Ventura 13.x, Sonoma 14.x, and Sequoia 15.x prior to July 2025 security updates. Despite a critical CVSS 9.8 score suggesting network-based exploitation, the vulnerability actually requires local shortcut execution with no authentication (PR:N), making the CVSS vector potentially misaligned with the actual attack surface. No public exploit identified at time of analysis, with EPSS score of 0.08% (24th percentile) indicating low predicted exploitation probability. Apple fixed the issue by adding mandatory user consent prompts.
Technical Context
The vulnerability resides in Apple's Shortcuts framework (CWE-284: Improper Access Control), a macOS automation system that allows users to create workflows with system-level capabilities. Shortcuts can interact with sensitive system settings, privacy controls, and application data. The flaw permitted a crafted shortcut to bypass permission checks that normally protect sensitive Shortcuts app configuration settings, executing privileged actions without triggering user consent prompts. This represents a failure in the authorization boundary between user-created automation scripts and protected system resources. The affected CPE strings indicate all three currently-supported macOS major versions were vulnerable: Ventura (13.x prior to 13.7.7), Sonoma (14.x prior to 14.7.7), and Sequoia (15.x prior to 15.4). The fix involved adding explicit consent prompts before allowing shortcuts to modify or access protected settings, implementing proper authorization gates that were previously missing.
Affected Products
Apple macOS Ventura versions prior to 13.7.7, macOS Sonoma versions prior to 14.7.7, and macOS Sequoia versions prior to 15.4 are affected. The vulnerability impacts the Shortcuts app framework across all three major supported macOS releases. Vendor advisories are available at Apple security pages HT215373 for Ventura 13.7.7, HT215150 for Sonoma 14.7.7, and HT215151 for Sequoia 15.4. Detailed CPE identifiers confirm the broad surface across Apple's macOS operating system family, though specific version ranges indicate only users who have not applied July 2025 security updates remain vulnerable.
Remediation
Vendor-released patches are available: upgrade to macOS Ventura 13.7.7, macOS Sonoma 14.7.7, or macOS Sequoia 15.4, all released in July 2025. Apply security updates through System Settings > General > Software Update or via Apple's enterprise deployment tools. Full remediation details are documented in Apple security advisories at https://support.apple.com/en-us/122373 (Ventura), https://support.apple.com/en-us/124150 (Sonoma), and https://support.apple.com/en-us/124151 (Sequoia). As a temporary mitigation for environments unable to immediately patch, restrict shortcut installation to trusted sources only, disable untrusted shortcut execution in System Settings > Privacy & Security > Shortcuts, and audit existing installed shortcuts for suspicious permission requests. However, these workarounds do not fully address the underlying authorization bypass and should not replace timely patching.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today