A permissions issue within macOS allows an application to read sensitive user data that it should not have access to. The flaw stems from insufficient restriction on access controls, leading to potential data exposure, as defined by CWE‑200. An attacker could exploit the vulnerability by running or installing a malicious app that gains elevated permissions during operation, thereby obtaining personal information or proprietary files residing on the user’s machine.

This vulnerability affects Apple macOS on three major code names—Sequoia, Sonoma, and Tahoe. Versions prior to macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, and macOS Tahoe 26.1 carry the issue. All other macOS releases are unaffected by the reported permissions problem.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is local or involves privileged apps, since an app must run with the necessary permissions to access restricted data. An attacker would need to install or run a trusted application that can exploit the permission gap.