Description
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.3, macOS Tahoe 26.2. An app may be able to access sensitive user data.
Published: 2025-12-12
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Access Sensitive User Data
Action: Patch
AI Analysis

Impact

An application can access sensitive user data due to a permissions issue on macOS. The flaw is a lack of proper restriction on data exposure, corresponding to CWE‑200 Non‑Authoritative Information Disclosure. This allows an app to read private data that should be protected, though it does not provide execution or privilege escalation.

Affected Systems

Apple macOS is affected. The issue is fixed in macOS Sequoia 15.7.3 and macOS Tahoe 26.2, so all earlier releases of Sequoia and Tahoe are vulnerable.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity. The EPSS score of less than 1 % implies a low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local, where a user installs or runs a malicious app that takes advantage of the permissions flaw to read private data.

Generated by OpenCVE AI on April 22, 2026 at 20:37 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install macOS Sequoia 15.7.3 or later
  • Install macOS Tahoe 26.2 or later
  • Verify or revoke permissions for applications that require sensitive data, removing any unnecessary apps with elevated access

Generated by OpenCVE AI on April 22, 2026 at 20:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 22 Apr 2026 21:00:00 +0000

Type Values Removed Values Added
Title Permissions Issue Allowing App to Access Sensitive User Data on macOS

Thu, 02 Apr 2026 20:30:00 +0000

Type Values Removed Values Added
Description A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.2, macOS Sequoia 15.7.3. An app may be able to access sensitive user data. A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.3, macOS Tahoe 26.2. An app may be able to access sensitive user data.

Wed, 17 Dec 2025 21:00:00 +0000

Type Values Removed Values Added
Description A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.3. An app may be able to access sensitive user data. A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.2, macOS Sequoia 15.7.3. An app may be able to access sensitive user data.
References

Tue, 16 Dec 2025 18:45:00 +0000

Type Values Removed Values Added
Weaknesses NVD-CWE-noinfo
CPEs cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

Tue, 16 Dec 2025 15:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 14 Dec 2025 21:30:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Vendors & Products Apple
Apple macos

Fri, 12 Dec 2025 21:15:00 +0000

Type Values Removed Values Added
Description A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.3. An app may be able to access sensitive user data.
References

Subscriptions

Apple Macos
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-04-02T18:23:20.948Z

Reserved: 2025-04-16T15:27:21.197Z

Link: CVE-2025-43523

cve-icon Vulnrichment

Updated: 2025-12-16T14:45:18.259Z

cve-icon NVD

Status : Modified

Published: 2025-12-12T21:15:57.113

Modified: 2026-04-02T19:20:59.563

Link: CVE-2025-43523

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-22T20:45:27Z

Weaknesses