A permissions flaw in Apple macOS allows certain applications to read protected user data that should otherwise be inaccessible. This weakness is categorized as CWE‑284: Improper Access Control. The insufficient access controls enable an app with the wrong privileges to bypass normal safeguards. Because the flaw directly compromises data confidentiality, an attacker could view or exfiltrate sensitive information.

Apple macOS operating systems are impacted. The fix has been applied in macOS Tahoe 26.5. All earlier releases without the patch are vulnerable.

The EPSS score is < 1%, and the CVSS score of 7.5 indicates a high severity; the vulnerability is not listed in the CISA KEV catalog, indicating limited evidence of public exploitation. However, the flaw's nature - granting an app the ability to access protected data - presents a significant confidentiality risk if exploited. The attack vector is likely local, requiring the attacker to install or execute an application on the affected system that exploits the permission lapse. The impact is system-wide for the compromised account, and the severity would rise if the affected application processes data written to untrusted locations.