A logic error in macOS lets iCloud Private Relay fail to activate when more than one user account is logged in concurrently. This flaw causes the protective privacy relay to remain inactive for all users, potentially allowing network traffic to bypass encryption or routing through standard internet paths. The vulnerability does not provide code execution or elevated privileges, but it undermines the privacy guarantees of iCloud Private Relay, representing a denial or degradation of the feature.

Apple macOS (Sequoia) versions prior to 15.6 are affected. The issue surfaces on systems where multiple user sessions are active simultaneously, regardless of the individual user roles.

The CVSS score is 5.3, indicating moderate severity. The EPSS score is below 1%, suggesting a low probability of exploitation in the wild. It is not listed in the CISA KEV catalog. Exploitation would likely require an environment where multiple users can log in, such as on a shared machine. An attacker could use this to prevent the activation of Private Relay, thereby stripping privacy protections during simultaneous logins, but cannot gain arbitrary code execution or system compromise.