EUVD-2026-77970
GHSA-pj99-xj25-m8rw
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local malicious app already executing (AV:L/PR:L), no UI; scoped 'sensitive user data' read supports C:L rather than the vendor's generous C:H, with no integrity or availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
An authorization issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access sensitive user data.
AnalysisAI
An incorrect authorization check in Apple macOS lets an application already running on a Mac read sensitive user data it should not be able to reach, an impact limited to confidentiality with no code execution, modification, or denial of service. Exploitation requires local code execution on the target (the assessed vector is AV:L/PR:L/UI:N), so it is only reachable by a malicious or attacker-controlled app already present on the device, and only on unpatched systems below macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the ability to execute an application locally on the affected Mac (PR:L, AV:L), i.e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All signals point to a moderate, locally-scoped risk rather than an urgent priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patches are available: upgrade macOS Sequoia to 15.8, macOS Tahoe to 26.7, or macOS Golden Gate to 27 as applicable, per Apple advisories https://support.apple.com/en-us/149035, https://support.apple.com/en-us/149042, and https://support.apple.com/en-us/149043. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today