An app may read a user's Contacts data without the user's consent due to a permissions defect. The vulnerability permits the discovery and export of private contact information, compromising user privacy and confidentiality. It is classified as a false privilege escalation (CWE-284).

All macOS Sequoia releases prior to version 15.1 are affected. Apple has addressed the issue in macOS Sequoia 15.1. The problem does not apply to earlier macOS major versions that are not part of the Sequoia line.

The CVSS score of 7.1 indicates high risk, though the EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog. An attacker likely needs local access to install or run an application that can exploit the lapse in permission checks. Exploitation does not require elevated privilege or remote connectivity, but any application running under the victim’s account can access contacts without prompting the user, making it relatively easy to harvest sensitive data.