An authorization flaw in macOS allows an application to obtain access to protected user data that it should not normally be able to read. The vulnerability stems from improper state management and is identified as an improper authorization issue (CWE-285). The impact is that a malicious or compromised application could read data that a user expects to remain protected, potentially exposing personal information or sensitive information stored on the device.

Apple macOS systems are affected by this issue, with the fix introduced in macOS Tahoe version 26.4. All earlier releases lacking this update are vulnerable, while systems running 26.4 or later are considered patched.

The CVSS score of 5.5 indicates a medium level of severity. EPSS shows less than 1 percent likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is not explicitly documented, but given the nature of authorization flaws, the most likely scenario involves a local malicious application leveraging the flaw to read protected data; this inference is drawn from the description rather than direct evidence in the provided data.