Apple identified a permissions flaw that allows an application to access sensitive user data that should be protected. The weakness is an improper authority granting issue, aligned with CWE‑284. This flaw can lead to unauthorized disclosure of personal information if an attacker can run an application that the system incorrectly trusts to retrieve protected content.

The issue impacts macOS installations on Apple devices of any release older than macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, and macOS Tahoe 26.4. Users running earlier versions are susceptible; the updates add the necessary restrictions to deny the access attempt.

The CVSS score of 5.3 reflects medium severity, while an EPSS score of less than 1% indicates low expected exploitation frequency. The flaw is not listed in CISA’s KEV catalog. Based on the description, exploitation likely requires local execution: a user installs or runs an application that the system misclassifies as allowed to read sensitive data. No remote exploitation vector is stated in the data.