EUVD-2026-15056
GHSA-8j6h-jv9f-2r4r
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | While CVSS and EPSS scores are not publicly available for this vulnerability, the real-world risk is significant due to the nature of the flaw: Gatekeeper bypass represents a critical security boundary violation on macOS. The attack vector appears to be local or local-adjacent (user must interact with an application), and the technical impact is high—successful exploitation allows unauthorized code execution with the privileges of the executing application. The fact that Apple classified this as a permissions issue requiring additional restrictions suggests the original fix may have been incomplete. Without disclosed KEV or POC availability data, this should be treated as a high-priority patch based on the attack surface (all macOS Tahoe systems) and the severity of bypassing code execution controls. |
| Exploit ScenarioDerived | An attacker distributes a malicious application through social engineering, email, or a compromised website. When a user downloads and attempts to execute the application, Gatekeeper would normally block execution due to lack of a valid signature or notarization. However, the vulnerable application leverages the permissions bypass flaw to execute arbitrary code despite Gatekeeper's objections, potentially establishing persistence or exfiltrating sensitive user data. The local attack vector means the user must be tricked into running the malicious application, but once executed, full code execution is achieved. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
A permissions validation flaw in macOS Tahoe allows applications to circumvent Gatekeeper security checks, potentially enabling execution of untrusted or malicious code that would normally be blocked by Apple's code signing and notarization mechanisms. This vulnerability affects macOS Tahoe versions prior to 26.4 and is fixed in the 26.4 release. An attacker with the ability to distribute a specially crafted application could bypass endpoint security controls designed to protect users from unsigned or malicious software.
RemediationAI
Immediately upgrade to macOS Tahoe 26.4 or later to remediate this vulnerability. Users should navigate to System Settings > General > Software Update and install all available updates. Organizations should prioritize deployment of this patch across all macOS Tahoe systems given the critical nature of Gatekeeper bypass. Until patching is completed, enforce application execution policies through third-party endpoint detection and response solutions and restrict administrative privileges to limit the scope of compromise if a malicious application is executed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Gatekeeper is macOS's foundational security mechanism that validates code signatures and notarization status before allowing application execution. This vulnerability represents a weakness in the permission validation logic within Gatekeeper's enforcement layer, allowing applications to bypass these checks through insufficient access control validation. The issue is classified as a permissions/authorization bypass vulnerability affecting the core macOS operating system (CPE: cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*). Rather than a specific CWE being disclosed, the root cause appears to be improper input validation or authorization checks in the Gatekeeper subsystem's permission enforcement mechanism.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.4. An app may bypass Gatekeeper checks.
Executive ViewAI
CVE-2026-20684 is a low-severity vulnerability in A permissions (CVSS 3.3). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation. Apply vendor updates when available as part of routine maintenance.
Apply vendor patch during routine maintenance. Standard security controls provide adequate interim protection.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB