A permissions issue in macOS allows an application that runs with root privileges to read private information that should be protected. The flaw is classified as a CWE‑284 missing or inappropriate authorization. If an attacker can execute code as root or otherwise obtain root privileges, they can bypass the normal access controls and gather confidential data, potentially exposing sensitive user information.

Apple macOS, versions released before macOS Sequoia 15.1. The vulnerability has been fixed in Sequoia 15.1 and later releases.

The CVSS score of 7.5 indicates a medium-to-high severity vulnerability. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, which suggests it may not yet be actively exploited. However, because the exploit requires root‑level execution, the attack vector is limited to scenarios where the attacker already has or can elevate to root privileges. Once root access is achieved, the attacker can immediately read private data and compromise confidentiality.