EUVD-2026-15091Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | Without published CVSS, EPSS, or KEV data, real-world risk assessment is limited but can be inferred from available signals. The vulnerability is rated as information disclosure with authorization bypass implications, suggesting moderate to high technical impact (CIA triad, specifically Confidentiality). The fact that Apple patched three separate macOS versions concurrently indicates broad applicability and sufficient severity to warrant rapid distribution. The absence of active exploitation evidence (no KEV listing) and the proactive patch release suggest this is a discovered-but-not-exploited vulnerability. However, the authorization bypass nature and access to sensitive user data make this a priority for patching, particularly for users handling confidential information. The lack of CVSS/EPSS metrics prevents quantitative risk scoring, but the multi-version patch scope and information disclosure impact warrant classification as moderate-to-high priority. |
| Exploit ScenarioDerived | A malicious or compromised third-party application installed on a vulnerable macOS system exploits the authorization state management flaw to request access to sensitive user data (e.g., contacts, photos, browsing history, or keychain credentials) that should be protected by macOS sandbox restrictions. Due to the improper state management, the OS fails to validate the application's actual entitlements, allowing the app to read data beyond its declared permissions. An attacker could bundle this exploit in a trojanized utility, social engineering, or supply chain attack to harvest user information without triggering typical user consent prompts or audit alerts. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
An authorization bypass vulnerability in macOS allows applications to access sensitive user data through improper state management of access controls. The vulnerability affects macOS Sequoia (before 15.7.5), macOS Sonoma (before 14.8.5), and macOS Tahoe (before 26.4). While no CVSS score, EPSS data, or KEV status is currently published, Apple has released patches addressing this issue, indicating it was discovered through internal review rather than active exploitation.
RemediationAI
Immediately upgrade to patched versions: macOS Sequoia 15.7.5 or later, macOS Sonoma 14.8.5 or later, or macOS Tahoe 26.4 or later. Users should access System Settings > General > Software Update and install available updates. For enterprise environments, deploy updates via Mobile Device Management (MDM) or Software Update Server (SUS) to ensure rapid rollout. Until updates can be deployed, restrict application installation to trusted sources only, disable untrusted third-party applications, and review system audit logs (log stream in Terminal) for suspicious inter-process access patterns. Consult Apple support documents at https://support.apple.com/en-us/126794, https://support.apple.com/en-us/126795, and https://support.apple.com/en-us/126796 for additional details and confirmation of patch status.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability stems from an authorization/access control failure (related to CWE class vulnerabilities involving improper state management) in the macOS operating system kernel or system frameworks that handle application sandbox and entitlement enforcement. The affected products, as specified by CPE cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*, span multiple macOS versions. The root cause appears to be inadequate state validation when applications request access to protected user data resources, allowing improper elevation of privilege or bypass of OS-level access controls that normally mediate inter-process communication and file/resource access boundaries.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to access sensitive user data.
Executive ViewAI
Organizations using An authorization should be aware of moderate risk from CVE-2026-28824, a improper access control vulnerability rated CVSS 5.3. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in macOS Tahoe 26.4 Security Updates
View all 67An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
GitHub PoC
Exploit-DB