The flaw is an authorization weakness that enables an application to read sensitive user data without the required permissions, potentially leading to data disclosure. The vulnerability arises from deficient state management that fails to enforce proper access controls. As a result, an app with sufficient local execution context could bypass user‑level safeguards and expose private information.

Apple macOS Tahoe releases earlier than version 26.4 are affected. The fix is incorporated in macOS Tahoe 26.4, so systems running any earlier build remain vulnerable.

The EPSS score of less than 1% indicates a low probability of active exploitation, and the CVSS score of 5.5 denotes moderate risk. The vulnerability is not listed in CISA KEV. Exploitation would likely occur through a locally running application that can take advantage of the flawed authorization logic; no publicly documented remote or network attack vector is provided.