Admin By Request CVE-2026-78237

Exploitation requires the attacker to have a standard (low-privileged) local user account on a macOS system with Admin By Request installed and running. The high attack complexity (AC:H) reflects that exploitation must occur during an active ABR privilege elevation session - the attacker must reach a specific input path within ABR's workflow where user-supplied data is processed and written to the sudoers file without adequate sanitization. Remote exploitation is not possible (AV:L); the attacker must be locally authenticated to the macOS endpoint. What limits exploitation: the attack cannot be performed remotely; the attacker must understand ABR's internal elevation flow sufficiently to identify and reach the vulnerable input point; and AC:H implies specific timing or configuration conditions beyond simply having a session open. Authentication requirements are confirmed by CVSS PR:L - a valid low-privileged local account is required.

The CVSS 3.1 base score of 7.8 with vector AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H reflects the attack's local-only reach, elevated complexity (requires an active ABR session and a specific input injection path), and transformative impact: persistent root on the host after session termination. Scope:Changed correctly captures that the compromise extends beyond ABR itself to the underlying macOS system via sudoers. No EPSS score is available in the provided data, and the vulnerability is not in CISA KEV, so no confirmed widespread exploitation exists at time of analysis. No public proof-of-concept is referenced. The real-world risk is context-dependent: environments deploying ABR specifically to restrict admin rights on macOS endpoints face a scenario where a determined low-privileged user can permanently undo those controls - making this a direct bypass of the security product's core function. The AC:H rating (high complexity) is a meaningful mitigating signal: exploitation is not trivial and requires understanding ABR's internal elevation workflow. However, for insider threat or post-initial-access scenarios, the payoff (persistent, unrestricted root) makes the effort worthwhile. No CVSS/description conflict identified.

A standard macOS user on a corporate endpoint initiates a legitimate ABR privilege elevation request and, during the session input phase, supplies a crafted string that ABR writes without sanitization into the sudoers file - for example, appending a rule granting themselves NOPASSWD root for all commands. After the ABR session expires and the temporary elevation is revoked, the injected sudoers entry remains intact, giving the user persistent, unrestricted root access via sudo without further interaction. No public proof-of-concept exploit has been identified at time of analysis, but the attack is mechanically straightforward for someone who understands ABR's elevation input handling.