The vulnerability is a permissions issue in Apple macOS that permits an application to access protected user data that should remain confidential. Classified as CWE‑284: Improper Access Control, the flaw was remedied with additional restrictions in macOS Sequoia 15.8 and macOS Tahoe 26.5. An attacker who can run or install a malicious application could exploit the lapse to read or exfiltrate sensitive user information, directly compromising data confidentiality.

Apple macOS operating systems are impacted. The fix has been applied in macOS Tahoe 26.5. All earlier releases without the patch are vulnerable.

The EPSS score is < 1%, and the CVSS score of 7.5 indicates a high severity; the vulnerability is not listed in the CISA KEV catalog, indicating limited evidence of public exploitation. However, the flaw’s nature - granting an app the ability to access protected data - presents a significant confidentiality risk if exploited. The attack vector is likely local, requiring the attacker to install or execute an application on the affected system that exploits the permission lapse. The impact is system-wide for the compromised account.