The flaw allows an application to read user‑sensitive data that it should be restricted from accessing. Adding additional logic intended to mitigate an earlier issue inadvertently left a weakness that permits malicious or poorly designed apps to bypass normal permission checks. This is a classic access‑control failure classified as CWE‑284, compromising the confidentiality and integrity of private information such as files, contacts, or system settings.

Apple macOS is affected. The vulnerability exists in releases prior to macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, and macOS Tahoe 26.1. Updating to these or later versions resolves the issue. No other vendors or products are listed as impacted.

The CVSS score of 5.5 indicates moderate severity. The EPSS score is below 1%, showing that the likelihood of exploitation is very low at the time of analysis. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local, requiring a malicious or misbehaving application to run on the user's machine and exploit the weakened permission model. No public exploits are known, so while the risk is low, applying the patch is advised.