An authorization flaw in macOS allows an application to read sensitive user data that it should not have access to. The vulnerability arises from insufficient state management that can be exploited by any app running on the system. This can lead to unauthorized disclosure of confidential information, violating both confidentiality and integrity.

Apple macOS is affected. The issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, and macOS Tahoe 26.4. All prior releases that have not applied the latest security update are potentially vulnerable. The vulnerability impacts devices running those macOS versions where the state management enforcement is not in place.

The CVSS score is 5.5, indicating medium severity, and the EPSS score is below 1%, suggesting a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Because the flaw permits an application to read sensitive data, a local or application‑level attacker could potentially exploit the vulnerability by installing a malicious app or by using a trusted app with elevated privileges. The attack vector is inferred to be application‑based within the local system context. The overall risk is moderate, but applying the patch reduces the risk to zero.