An authorization issue exists in macOS that allows a malicious or compromised application to bypass proper access controls and read sensitive user data it should not access. The flaw arises from insufficient state management, representing a mis‑implementation of access control (CWE‑285). It can lead to confidentiality loss for the affected user.

Apple macOS versions before Sequoia 15.7.4, Sonoma 14.8.4, and Tahoe 26 lack the patched state management and remain vulnerable to the authorization bypass.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Likely exploitation requires a locally installed or sideloaded application that leverages the flawed authorization to acquire protected data; any successful exploit results in unauthorized disclosure of user information.