An authorization flaw in macOS allows a malicious application to bypass user-configured privacy preferences, potentially exposing protected data or system resources. The weakness is a missing authorization check that could lead to unauthorized access to privacy-controlled information. This issue could allow an attacker to read or modify user data that should be protected by the system's privacy controls.

Apple macOS installations prior to Sequoia 15.3, Sonoma 14.7.3, and Ventura 13.7.3 are vulnerable to this flaw. The vulnerability was addressed in those specific patch releases.

The CVSS score of 4.4 indicates moderate severity, while an EPSS score of less than 1% suggests a very low probability of exploitation at the time of this analysis. The flaw is not listed in the CISA KEV catalog. The most likely attack vector is local, involving a user running a malicious or compromised application that takes advantage of the omitted authorization check to gain unauthorized privacy access. This inference is based on the description of sandbox restrictions and the nature of the vulnerability.