Clearancekit CVE-2026-40191

CVSS v4.0 score of 6.8 with vector AV:L (local attack vector), AC:L (low complexity), PR:L (low privilege required), and VI:H (high integrity impact) indicates a moderate but real risk. The requirement for authenticated local access (PR:L) substantially restricts the threat model compared to remote or unauthenticated attacks. The high integrity impact reflects the core issue: an authenticated user can modify files in protected directories, potentially compromising system integrity or application data. CVSS does not provide exploitation probability; the ENISA EUVD catalog lists this as a confirmed vulnerability with a fix available. The absence of reported public exploit code or active exploitation signals suggests this is not an immediate critical priority compared to unauthenticated or remote-exploitable flaws, but the low attack complexity and authenticated-user availability make it a meaningful risk in multi-user or insider-threat scenarios. Organizations should prioritize patching based on their threat model and the sensitivity of file-system protections they rely on ClearanceKit to enforce.

An authenticated local user on a macOS system running vulnerable ClearanceKit could use a rename, link, or copyfile operation to move or replace a protected system file or application binary in a ClearanceKit-protected directory. Because the handler only checked the source path, the destination path protection would be bypassed. For example, a user could copy a malicious shared library into a protected application directory, potentially leading to privilege escalation or data manipulation depending on which processes load and execute the replaced file. Attack complexity is low since standard POSIX file operations can be used; however, the attacker requires local authentication and account access.