A permission flaw in macOS allows an application to enable iCloud storage features without the user’s consent, effectively bypassing the intended access control. The weakness is a Wrong Access Control (CWE‑276). This could let a malicious or compromised app store data in the user’s iCloud account without authorization, exposing personal information and undermining privacy.

Apple macOS products are affected. The vulnerability is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, and macOS Ventura 13.7.5. Any earlier releases remain vulnerable.

The CVSS score of 9.8 signals a critical level of risk and a high potential impact. The EPSS score of less than 1% indicates a very low current likelihood of exploitation, and the issue is not yet listed in the CISA KEV catalog. The likely attack vector is local: an application that runs on the affected macOS system can trigger the iCloud storage feature without prompting the user. No evidence is provided that remote exploitation is possible, but the flaw runs with the permissions of the executing application, making it a serious concern for any app that is installed or downloaded.