CVE-2025-43519

Permissions Misconfiguration Enabling App Access to Sensitive User Data

Published Dec 12, 2025 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2. An app may be able to access sensitive user data.

Analysis

Technical impact

A permissions issue was identified that could allow an application to access sensitive user data. The vulnerability arises from insufficient restrictions, enabling unauthorized data exposure. The flaw is categorized as CWE-276: Incorrect Permissions, indicating a misconfiguration in how permissions are enforced.

Affected Systems

Apple macOS is affected. Vulnerable versions include any macOS iterations prior to the release of macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, and macOS Tahoe 26.2. The issue is addressed in the specified patches for each major release.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity. The EPSS score of less than 1% suggests a low likelihood of exploitation at present. It is not listed in CISA’s KEV catalog. Based on the description, the attack vector is most likely local, requiring the application to run with elevated or incorrect permissions. The risk is therefore moderate to high for systems running affected macOS versions where untrusted applications may obtain sensitive data.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apple

macOS

affected

Version	Status	Constraints
`0`	affected	< 14.8.3
`0`	affected	< 15.7.3
`0`	affected	< 26.2

Configuration 1 [-]

OR	cpe:2.3:o:apple:macos::::::::
	cpe:2.3:o:apple:macos::::::::

No data.

Vendor	Product	Versions
Apple	Macos	—
Apple	Macos Sequoia	—
Apple	Macos Sonoma	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade macOS to Sequoia 15.7.3, Sonoma 14.8.3, or Tahoe 26.2 to fix the CWE-276 incorrect permissions flaw.
If an upgrade cannot be performed immediately, use sandboxing or permission restrictions to enforce the principle of least privilege and mitigate the CWE-276 issue.
Conduct a thorough permissions audit of user accounts and applications to identify and correct any elevated or misconfigured permissions, directly addressing the root cause of the CWE-276 vulnerability.

Generated by OpenCVE AI on April 28, 2026 at 10:18 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.359% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://support.apple.com/en-us/125886
https://support.apple.com/en-us/125887
https://support.apple.com/en-us/125888

History

Apr 28, 2026 10:45 AM Title updated View changes

Type	Values Removed	Values Added
Title		Permissions Misconfiguration Enabling App Access to Sensitive User Data

Apr 2, 2026 8:30 PM Description updated View changes

Type	Values Removed	Values Added
Description	A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.2, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3. An app may be able to access sensitive user data.	A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2. An app may be able to access sensitive user data.

Dec 17, 2025 9:00 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description	A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14.8.3, macOS Sequoia 15.7.3. An app may be able to access sensitive user data.	A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.2, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3. An app may be able to access sensitive user data.
References		https://support.apple.com/en-us/125886

Dec 17, 2025 7:15 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-276
Metrics	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}`	ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}` cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}`

Dec 16, 2025 9:00 PM Weaknesses updated. Affected versions updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:o:apple:macos::::::::
Metrics		cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}`

Dec 14, 2025 9:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Apple Apple macos Apple macos Sequoia Apple macos Sonoma
Vendors & Products		Apple Apple macos Apple macos Sequoia Apple macos Sonoma

Dec 12, 2025 9:15 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description		A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14.8.3, macOS Sequoia 15.7.3. An app may be able to access sensitive user data.
References		https://support.apple.com/en-us/125887 https://support.apple.com/en-us/125888