NoSleep 1.5.1 allows a privileged XPC Mach service to accept raw dictionary messages containing attacker‑controlled command and NSBundlePath values. Because the service runs with elevated privileges, an attacker can exploit this flaw to read files owned by the root user, resulting in confidential data disclosure. This vulnerability is a missing authorization check for a privileged resource (CWE‑862).

The affected product is the NoSleep application version 1.5.1 running on macOS. Only this specific version is known to be vulnerable.

The CVSS score of 6.9 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog. Based on the description, the likely attack vector is a local privileged XPC service; a local user or process that can communicate with the mach service could send crafted messages to read root‑owned files. The exploitability requires the XPC helper to be running with root privileges and the absence of authorization checks. Because the service operates locally, the risk is limited to local footholds, but the impact of exposed root data is significant.