A permissions issue in Apple macOS (CWE‑284: Improper Access Control) allowed an application to read or otherwise access sensitive user data without proper authorization. The vulnerability was mitigated by removing the vulnerable code segment, eliminating the enforcement gap that permitted this data disclosure. The result is a direct privacy breach that could expose personally identifying information or other confidential data.

Apple’s macOS platform is affected, with the flaw present in versions prior to macOS Tahoe 26. The security fix was shipped in macOS Tahoe 26, which removes the problematic code path.

The flaw likely requires local code execution or the installation of a malicious application to exploit the missing permission check; the attack vector is inferred to be local. The CVSS score is 5.5, indicating moderate severity, and the EPSS score is not available, with the vulnerability not listed in the CISA KEV catalog. Consequently, while the precise risk level cannot be quantified, the moderate severity indicated by the CVSS score 5.5 and lack of widespread exploitation evidence suggest moderate potential impact for impacted systems.