Description
A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7.4, macOS Tahoe 26.3. An app may be able to access protected user data.
Published: 2026-02-11
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorised access to protected user data
Action: Apply patch
AI Analysis

Impact

A permissions issue, addressed by removing the vulnerable code, allows an application to read protected user data that it should not be able to access. The weakness is categorized as information exposure and can lead to confidentiality loss if a malicious or compromised app can read or exfiltrate personal files or system data. The issue is fixed in macOS Sequoia 15.7.4 and macOS Tahoe 26.3.

Affected Systems

Apple macOS versions prior to macOS Sequoia 15.7.4 or macOS Tahoe 26.3 are vulnerable.

Risk and Exploitability

Based on the description, it is inferred that an attacker would need to run a malicious or compromised application locally with elevated privileges or bypass sandbox restrictions to exploit the issue. The CVSS score of 5.5 indicates moderate risk, while the EPSS score of less than 1 % reflects a very low probability of exploitation. It is not listed in the CISA KEV catalog, indicating no publicly known widespread attacks.

Generated by OpenCVE AI on August 22, 2026 at 11:47 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade macOS to version 26.3 or later where the permission check has been removed.
  • Update all third‑party applications to their latest releases, ensuring they no longer rely on the removed code path.
  • Enforce stricter app sandboxing and location permissions in System Settings → Security & Privacy to limit access to protected system directories for untrusted applications.

Generated by OpenCVE AI on August 22, 2026 at 11:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 22 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
Title macOS Permissions Issue Enabling Unauthorized Access to Protected User Data

Fri, 21 Aug 2026 01:00:00 +0000

Type Values Removed Values Added
Description A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Tahoe 26.3. An app may be able to access protected user data. A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7.4, macOS Tahoe 26.3. An app may be able to access protected user data.
References

Wed, 15 Apr 2026 21:15:00 +0000

Type Values Removed Values Added
Title macOS Permissions Issue Enabling Unauthorized Access to Protected User Data

Fri, 13 Feb 2026 19:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

Fri, 13 Feb 2026 18:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 12 Feb 2026 09:45:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Vendors & Products Apple
Apple macos

Wed, 11 Feb 2026 23:15:00 +0000

Type Values Removed Values Added
Description A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Tahoe 26.3. An app may be able to access protected user data.
References

Subscriptions

Apple Macos
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-08-21T00:39:03.477Z

Reserved: 2025-11-11T14:43:07.859Z

Link: CVE-2026-20623

cve-icon Vulnrichment

Updated: 2026-02-13T17:24:21.606Z

cve-icon NVD

Status : Modified

Published: 2026-02-11T23:16:05.787

Modified: 2026-08-21T01:16:57.383

Link: CVE-2026-20623

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-22T12:00:04Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor