EUVD-2026-15035
GHSA-vcpf-hjm3-54fr
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | Without a published CVSS vector, EPSS score, or KEV status from CISA, the real-world risk assessment relies on the nature of the vulnerability itself. The vulnerability is classified as an information disclosure issue with a permissions/authorization root cause, suggesting local attack vector (an application must run on the system) with likely low-to-medium complexity depending on how easily an attacker can craft a malicious app. The fact that Apple released patches across three major OS versions indicates this was a cross-version issue deemed important enough for coordinated remediation. The absence of CVSS scoring and public POC suggests this may not be actively exploited in the wild, but the broad patch distribution across multiple OS generations indicates significant scope. Priority should be elevated given the sensitivity of protected user data (contacts, photos, location, health) and the ease with which a local application could exploit this if delivered via malware or a compromised app. |
| Exploit ScenarioDerived | An attacker distributes a malicious application (via phishing, app store compromise, or supply chain attack) that, once installed and executed on a vulnerable macOS system, exploits the permissions enforcement weakness to access protected user data such as photos, contacts, location history, or health information without displaying the normal permission prompts or requiring explicit user consent. The attacker exfiltrates this sensitive data to a remote server, compromising user privacy at scale. Since the attack requires local execution of an application, it would typically be delivered as part of a broader malware campaign or social engineering attack targeting macOS users. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
A permissions enforcement vulnerability in macOS allows applications to bypass security restrictions and access protected user data due to insufficient authorization checks. This issue affects macOS Sequoia (prior to 15.7.5), macOS Sonoma (prior to 14.8.5), and macOS Tahoe (prior to 26.4). An attacker with the ability to execute an application on the affected system could potentially access sensitive user information without proper user consent or authorization. No CVSS score, EPSS data, or active exploitation in the wild (KEV status) has been disclosed by Apple.
RemediationAI
Immediately apply the latest security updates provided by Apple: upgrade macOS Sequoia to version 15.7.5 or later, upgrade macOS Sonoma to version 14.8.5 or later, or upgrade macOS Tahoe to version 26.4 or later. Users should check System Preferences > General > Software Update to download and install the latest patches, which require a system restart. For organizations, deploy these updates through Mobile Device Management (MDM) or macOS security update tools to ensure rapid deployment across all systems. As a temporary mitigation prior to patching, restrict user permissions to install untrusted applications, disable third-party app installation, and enable Gatekeeper and XProtect settings to prevent execution of potentially malicious applications. Refer to the vendor advisories at https://support.apple.com/en-us/126794, https://support.apple.com/en-us/126795, and https://support.apple.com/en-us/126796 for additional details and deployment guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability stems from a permissions and access control issue within the macOS operating system, classified as an information disclosure weakness. The root cause involves insufficient enforcement of user data protection mechanisms, allowing applications to circumvent the permission boundaries that normally restrict access to sensitive user files and information. The affected product is the Apple macOS operating system across multiple major versions (Sequoia 15.x, Sonoma 14.x, and Tahoe 26.x), as indicated by CPE identifiers matching 'cpe:2.3:a:apple:macos'. Rather than a specific vulnerable library or protocol, this represents a system-level authorization control defect where the OS kernel or system frameworks fail to properly validate application entitlements before granting access to protected data categories such as contacts, photos, location, health data, or other privacy-sensitive information.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to access protected user data.
Executive ViewAI
Organizations using A permissions should be aware of moderate risk from CVE-2026-20607, a improper privilege management vulnerability rated CVSS 4.0. Attackers could gain access beyond their authorized level. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Related Vulnerabilities in macOS Tahoe 26.4 Security Updates
View all 67An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB