Description
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2. An app may be able to access sensitive user data.
Published: 2025-12-12
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized access to sensitive user data
Action: Immediate Patch
AI Analysis

Impact

A permissions issue was identified that could allow an application to access sensitive user data. The vulnerability arises from insufficient restrictions, enabling unauthorized data exposure. The flaw is categorized as CWE-276: Incorrect Permissions, indicating a misconfiguration in how permissions are enforced.

Affected Systems

Apple macOS is affected. Vulnerable versions include any macOS iterations prior to the release of macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, and macOS Tahoe 26.2. The issue is addressed in the specified patches for each major release.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity. The EPSS score of less than 1% suggests a low likelihood of exploitation at present. It is not listed in CISA’s KEV catalog. Based on the description, the attack vector is most likely local, requiring the application to run with elevated or incorrect permissions. The risk is therefore moderate to high for systems running affected macOS versions where untrusted applications may obtain sensitive data.

Generated by OpenCVE AI on April 28, 2026 at 10:18 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade macOS to Sequoia 15.7.3, Sonoma 14.8.3, or Tahoe 26.2 to fix the CWE-276 incorrect permissions flaw.
  • If an upgrade cannot be performed immediately, use sandboxing or permission restrictions to enforce the principle of least privilege and mitigate the CWE-276 issue.
  • Conduct a thorough permissions audit of user accounts and applications to identify and correct any elevated or misconfigured permissions, directly addressing the root cause of the CWE-276 vulnerability.

Generated by OpenCVE AI on April 28, 2026 at 10:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 28 Apr 2026 10:45:00 +0000

Type Values Removed Values Added
Title Permissions Misconfiguration Enabling App Access to Sensitive User Data

Thu, 02 Apr 2026 20:30:00 +0000

Type Values Removed Values Added
Description A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.2, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3. An app may be able to access sensitive user data. A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2. An app may be able to access sensitive user data.

Wed, 17 Dec 2025 21:00:00 +0000

Type Values Removed Values Added
Description A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14.8.3, macOS Sequoia 15.7.3. An app may be able to access sensitive user data. A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.2, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3. An app may be able to access sensitive user data.
References

Wed, 17 Dec 2025 19:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-276
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Tue, 16 Dec 2025 21:00:00 +0000

Type Values Removed Values Added
Weaknesses NVD-CWE-noinfo
CPEs cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Sun, 14 Dec 2025 21:30:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Apple macos Sequoia
Apple macos Sonoma
Vendors & Products Apple
Apple macos
Apple macos Sequoia
Apple macos Sonoma

Fri, 12 Dec 2025 21:15:00 +0000

Type Values Removed Values Added
Description A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14.8.3, macOS Sequoia 15.7.3. An app may be able to access sensitive user data.
References

Subscriptions

Apple Macos Macos Sequoia Macos Sonoma
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-04-02T18:22:49.520Z

Reserved: 2025-04-16T15:27:21.196Z

Link: CVE-2025-43519

cve-icon Vulnrichment

Updated: 2025-12-16T15:29:00.760Z

cve-icon NVD

Status : Modified

Published: 2025-12-12T21:15:56.727

Modified: 2026-04-02T19:20:58.893

Link: CVE-2025-43519

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-28T10:30:29Z

Weaknesses