A flaw in the macOS operating system allows applications to read the user's contacts without seeking explicit user consent, representing an improper authorization control identified as CWE-284. The unauthorized disclosure of personal data—such as names, emails, phone numbers, and addresses—can facilitate privacy violations, phishing, and identity‑theft attempts.

Apple macOS Sequoia versions prior to 15.1 are affected; the issue is resolved in macOS Sequoia 15.1 and later releases. Devices running any build of Sequoia 15.0 or earlier are susceptible.

The CVSS score of 7.1 signifies a high severity impact, while the EPSS score of less than 1% indicates a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been reported. Based on the description, the exploitation vector is inferred to be local: any application installed on the system that can be executed by the user may gain contact data without permission.