EUVD-2026-15055
GHSA-6hg7-v5xr-46g2
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
An authorization issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14.8.4, macOS Tahoe 26.3. An app may be able to access sensitive user data.
AnalysisAI
An authorization bypass vulnerability in macOS allows applications to access sensitive user data through improper state management. The vulnerability affects macOS Sonoma 14.8.4 and earlier versions, as well as macOS Tahoe 26.3 and earlier, enabling unprivileged apps to circumvent authorization checks and obtain restricted user information. Apple has addressed this issue through patched releases, and no public exploitation activity or proof-of-concept code has been reported at this time.
Technical ContextAI
This vulnerability stems from insufficient state management in macOS authorization controls, classified as an information disclosure issue. The root cause involves authorization state not being properly validated or maintained during application execution, allowing apps to retain or escalate access to sensitive user data beyond their granted permissions. Affected products include the complete macOS platform (CPE: cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*), indicating the vulnerability exists in core operating system authorization mechanisms rather than a specific application component. The flaw represents a breach of the principle of least privilege in macOS's security model, where application sandbox and entitlement-based access controls have been bypassed due to state management weaknesses.
RemediationAI
Users should immediately upgrade to macOS Sonoma 14.8.4 or later, or macOS Tahoe 26.3 or later, depending on their current OS version. The patches can be downloaded and installed through System Settings > General > Software Update, or by visiting https://support.apple.com/en-us/126348 and https://support.apple.com/en-us/126350 for manual download options. For organizations unable to immediately patch, implement restrictive application allowlisting policies to limit which apps can execute, monitor system logs for suspicious data access patterns, and consider restricting user account privileges to standard (non-administrator) accounts where feasible. Additionally, review installed applications and disable those not essential to business operations, as this reduces the attack surface for malicious apps attempting to exploit the authorization bypass.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
A use-after-free issue was addressed with improved memory management. Rated high severity (CVSS 8.8), this vulnerability
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today