What is the CVSS score of CVE-2026-20696?

CVE-2026-20696 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-20696?

Yes, a patch is available for CVE-2026-20696. Update the affected software to the latest version immediately.

Apple macOS CVE-2026-20696

EUVD-2026-29213 MEDIUM

Missing Authorization (CWE-862)

2026-05-11 apple

GHSA-68mh-hg32-gwp6

Authentication Bypass Apple

5.5

CVSS 3.1 · Vendor: apple

Severity by source

Vendor (apple) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.5 MEDIUM

Local attack via installed app (AV:L), low-privilege app context sufficient (PR:L), high confidentiality breach, no integrity or availability impact applies.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 23:41 vuln.today

CVSS changed

May 12, 2026 - 19:22 NVD

5.5 (MEDIUM)

Patch available

May 11, 2026 - 22:03 EUVD

CVE Published

May 11, 2026 - 20:08 nvd

MEDIUM 5.5

CVE Published

May 11, 2026 - 20:08 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

An authorization issue was addressed with improved state management. This issue is fixed in macOS Tahoe 26.4. An app may be able to access sensitive user data.

AnalysisAI

Missing authorization checks in Apple macOS allow a locally installed app to access sensitive user data by exploiting improper state management during authorization decisions. All macOS versions prior to Tahoe 26.4 are affected per CPE data. Apple has patched the issue in macOS Tahoe 26.4; no public exploit has been identified and EPSS sits at the 5th percentile, indicating negligible opportunistic exploitation probability at time of analysis.

Technical ContextAI

The vulnerability is rooted in CWE-862 (Missing Authorization), a class of flaw where the software does not perform or correctly enforce an authorization check when an actor attempts to access a resource. Apple's advisory language - 'improved state management' - indicates the authorization gate was not enforced consistently across all application lifecycle states or privilege transitions within macOS. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms the attack is local and requires only a low-privileged app context, consistent with a sandboxed app finding a state condition in which OS-level access controls are momentarily absent. Affected product per CPE is cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*, covering all macOS versions up to but not including Tahoe 26.4.

RemediationAI

Vendor-released patch: macOS Tahoe 26.4. Update via System Settings > General > Software Update. The Apple security advisory covering this fix is available at https://support.apple.com/en-us/126794. If immediate upgrade is not possible, organizations should restrict installation of unvetted or untrusted third-party applications using Mobile Device Management (MDM) profiles or Gatekeeper policy enforcement, which limits the attack surface to apps that have already passed review. Note that MDM-based app restriction may impact user workflows that rely on sideloaded or developer-signed tools. No additional workarounds are documented in available references.