Description
An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to access sensitive user data.
Published: 2026-03-25
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized access to sensitive user data
Action: Patch
AI Analysis

Impact

An authorization flaw exists that could allow a malicious application to read sensitive user information on macOS. The vulnerability is an access control weakness (CWE‑284) resulting in a potential breach of confidentiality.

Affected Systems

The problem exists in macOS versions released before Sequoia 15.7.5, Sonoma 14.8.5, and Tahoe 26.4. Systems running those or earlier versions are affected.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% points to a low probability of exploitation. The CVE is not listed in the CISA KEV catalog. Attackers would likely need local access to run a malicious application, so the attack vector is inferred as local execution. The impact remains limited to data breach, but the overall risk is considered moderate to low.

Generated by OpenCVE AI on March 26, 2026 at 14:45 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install macOS 15.7.5, 14.8.5, or 26.4 to apply the fix
  • Verify that the operating system is up to date
  • Avoid installing untrusted applications

Generated by OpenCVE AI on March 26, 2026 at 14:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 27 Mar 2026 10:00:00 +0000

Type Values Removed Values Added
Title Authorization Issue Allows App to Access Sensitive User Data on macOS

Thu, 26 Mar 2026 12:30:00 +0000

Type Values Removed Values Added
Title Apple macOS authorization bypass enabling access to sensitive data
Weaknesses CWE-276

Wed, 25 Mar 2026 22:00:00 +0000

Type Values Removed Values Added
Title Apple macOS authorization bypass enabling access to sensitive data
Weaknesses CWE-276

Wed, 25 Mar 2026 21:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

Wed, 25 Mar 2026 20:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 25 Mar 2026 12:00:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Vendors & Products Apple
Apple macos

Wed, 25 Mar 2026 01:00:00 +0000

Type Values Removed Values Added
Description An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to access sensitive user data.
References

Subscriptions

Apple Macos
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-04-02T18:22:54.225Z

Reserved: 2026-03-03T16:36:03.968Z

Link: CVE-2026-28824

cve-icon Vulnrichment

Updated: 2026-03-25T19:36:13.972Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-25T01:17:07.593

Modified: 2026-03-25T21:31:10.343

Link: CVE-2026-28824

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-27T09:50:28Z

Weaknesses