A permissions flaw—classified as CWE‑284—allows an application to read sensitive user data that should be protected. The vulnerability is present in macOS Sequoia versions prior to 15.5 and can lead to unauthorized disclosure of personal information. The fixed version, Sequoia 15.5, adds additional restrictions to prevent this data leakage.

Vulnerable Apple macOS releases are any Sequoia generation earlier than 15.5. The issue affects all users running these versions, regardless of device model or configuration, as the flaw lies in the operating system's access‑control enforcement.

The CVSS score of 5.5 indicates a medium impact when the permission mistake occurs. An EPSS below 1% suggests that exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. The likely attack path involves a malicious or poorly configured local application that takes advantage of the overly permissive access controls, potentially exposing personal data without the user's knowledge. Because the flaw requires user or local device access, remote exploitation is not feasible.