EUVD-2026-77859
GHSA-x8pj-fh97-jf4v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessTrick user into running malicious app
-
DeliveryApp invokes affected macOS interface
-
ExploitMissing authorization check bypassed
-
ExecutionRead sensitive user data
-
ImpactExfiltrate private information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a malicious or compromised application to already be running locally on an affected macOS version (below Golden Gate 27, 26.7, or 15.8); there is no remote or network delivery path despite the AV:N rating. Exploitation is limited by the need to get the app onto the target device and executed, and impact is confined to reading sensitive user data (no integrity or availability effect). Gatekeeper/notarization, App Store review, and TCC prompts act as additional practical barriers to deploying such an app on default configurations. |
| Impact | This is a classic Apple 'improved validation' authorization flaw (CWE-862) where an app can access sensitive user data it should not. The vendor CVSS of 7.5 is driven entirely by AV:N/PR:N/UI:N with C:H, but this rating conflicts sharply with the description: 'An app may be able to access sensitive user data' describes a malicious application already running on the device, which is a LOCAL vector (AV:L) requiring the app to be installed and executed (PR:L), not a remote unauthenticated network attack. The AV:N/PR:N scoring is almost certainly inflated - Apple frequently rates local-app data-access issues as if they were network-reachable. Corroborating signals point to LOW real-world urgency: EPSS is only 0.19% (9th percentile), there is no CISA KEV listing, and no public exploit code is identified. Only confidentiality is affected (I:N/A:N), and impact is scoped to 'sensitive user data' rather than full system compromise. Net: this is a legitimate privacy/authorization bug worth patching in normal cycles, but the headline 7.5 overstates real-world risk - the true exposure is a locally-installed app reading data it shouldn't, closer to a mid-5 severity. Verify the vector with Apple's advisory, as CVSS indicates network vector but the description clearly implies local app-based access. |
| Exploit ScenarioDerived | A user installs a seemingly benign app from outside vetting (or a sandboxed app with limited entitlements). Due to the missing/insufficient permission validation, the app reads sensitive user data (e.g., protected files, personal information) that its granted permissions should not allow. No public proof-of-concept exists and no active exploitation is reported. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Authorization bypass in Apple macOS allows a malicious or compromised application already running on the system to access sensitive user data it should not be able to reach. All macOS releases below Golden Gate 27, Tahoe 26.7, and Sequoia 15.8 are affected; the flaw is rooted in missing authorization checks (CWE-862) that Apple addressed through improved permission validation. Per the independent assessment the practical attack path is local rather than remote - the attacker must first get an app onto the device and executed, with Gatekeeper, notarization, App Store review, and TCC prompts acting as added barriers - and impact is confined to confidentiality (data disclosure) with no integrity or availability effect. No public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS is low (0.19%, 9th percentile), so risk is driven primarily by the widespread install base rather than observed attacks.
RemediationAI
Vendor-released patches are available: macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7 address the missing authorization check, and administrators should update to or beyond those builds via Software Update, an MDM software-update policy, or the corresponding Apple security response, following the advisories at https://support.apple.com/en-us/149035, https://support.apple.com/en-us/149042, and https://support.apple.com/en-us/149043. Because exploitation requires a malicious app to already be running locally, the primary compensating controls are execution controls rather than network filtering: keep Gatekeeper and notarization enforcement enabled and avoid disabling them, restrict installations to the App Store or a signed/allow-listed software catalog (trade-off: friction and possible false blocks on legitimate in-house tools), and deploy MDM application controls so users cannot approve arbitrary unsigned apps. Where that is not feasible, reduce blast radius by limiting the amount of sensitive data stored in locations reachable by ordinary user-level apps, tightening TCC permissions for file, Full Disk Access, Contacts, and Location, and removing local admin rights from standard accounts - each of which lowers the value of the disclosed data but does not eliminate the vulnerability. Note that no public exploit code is known, no vendor workaround short of patching is documented, and upgrading to the fixed builds is the only complete fix; hosts that cannot be moved to 15.8, 26.7, or 27 should be treated as exposed until replaced.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a missing-authorization flaw (CWE-862) in Apple's macOS permission-enforcement layer: a process could reach sensitive user data without the intended entitlement, consent, or validation check being performed. Apple's description states the permissions issue was 'addressed with improved validation,' which in practice means Apple added or tightened the check that gated access to the protected resource, typically the sandbox/TCC (Transparency, Consent, and Control) machinery that arbitrates access to user files, location, contacts, and similar private data. The CPE entry cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:* confirms the affected platform is the macOS operating system across multiple branches rather than a standalone application. Although the vendor-published CVSS vector is given as AV:N/AC:L/PR:N/UI:N (7.5), our independent assessment re-scores it as AV:L/AC:L/PR:L/UI:N because exploitation requires code execution on the host: there is no network delivery primitive, and the actor is a local low-privileged process. Because the weakness class is an absent authorization check rather than memory corruption, the vulnerability does not by itself grant code execution - it grants over-broad read access to data the sandbox or TCC should have withheld.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
A locally-installed app must run to reach the flaw, so AV:L/PR:L; the authorization bypass yields read access to sensitive data (C:H) with no integrity or availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
A permissions issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access sensitive user data.
Executive ViewAI
Apple has fixed an authorization flaw in macOS that could let an application already running on a Mac read sensitive user data it was never granted access to. The exposure is limited to data disclosure rather than system takeover or downtime, and reaching it requires an attacker to first land and execute code on the device past Gatekeeper, notarization, and user consent prompts. Because Macs are widely deployed across the organization and vulnerable releases remain in use until updated, leadership should care primarily about fleet-wide patch coverage rather than active attacker pressure, as no public exploit has been identified and observed exploitation likelihood is low.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB