Description
This issue was addressed with improved entitlements. This issue is fixed in macOS Tahoe 26. An app may be able to access user-sensitive data.
Published: 2025-09-15
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Data Exposure
Action: Assess Impact
AI Analysis

Impact

This vulnerability arises from improper access control due to insufficient entitlement enforcement. The weakness, classified as CWE‑284, allows an application to read user‑sensitive information that it should not access. The issue was fixed in macOS Tahoe 26 through improved credential handling.

Affected Systems

Apple macOS systems, including all releases earlier than macOS Tahoe 26. Users running versions prior to 26 are affected and may allow applications to access private data.

Risk and Exploitability

The vulnerability has a CVSS score of 5.5, indicating moderate severity, and an EPSS score of less than 1%, suggesting low exploitation probability. It is not listed in CISA KEV. The likely attack vector is a local application executing on the user’s machine; an attacker would need to provide or trick the user into installing a malicious or overly privileged app.

Generated by OpenCVE AI on April 28, 2026 at 00:03 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to macOS Tahoe 26 or later to receive the entitlement fix.
  • Review installed applications to ensure they request only the entitlements needed for their functionality and revoke any unnecessary permissions.
  • If upgrading is not immediately possible, enforce application sandboxing and remove extraneous entitlements via MDM or system controls.

Generated by OpenCVE AI on April 28, 2026 at 00:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-29309 This issue was addressed with improved entitlements. This issue is fixed in macOS Tahoe 26. An app may be able to access user-sensitive data.
History

Tue, 28 Apr 2026 00:30:00 +0000

Type Values Removed Values Added
Title Improper Entitlement Enforcement Enabling Access to User Sensitive Data

Mon, 03 Nov 2025 19:30:00 +0000

Type Values Removed Values Added
References

Wed, 17 Sep 2025 13:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

Wed, 17 Sep 2025 11:00:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Vendors & Products Apple
Apple macos

Tue, 16 Sep 2025 18:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 15 Sep 2025 22:45:00 +0000

Type Values Removed Values Added
Description This issue was addressed with improved entitlements. This issue is fixed in macOS Tahoe 26. An app may be able to access user-sensitive data.
References

Subscriptions

Apple Macos
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-04-02T18:18:32.400Z

Reserved: 2025-04-16T15:24:37.088Z

Link: CVE-2025-43207

cve-icon Vulnrichment

Updated: 2025-11-03T18:09:40.152Z

cve-icon NVD

Status : Modified

Published: 2025-09-15T23:15:30.697

Modified: 2025-11-03T19:15:53.620

Link: CVE-2025-43207

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-28T00:15:05Z

Weaknesses