ClearanceKit, a macOS file‑system access interceptor, enforced per‑process access policies by monitoring only ES_EVENT_TYPE_AUTH_OPEN events. In versions 4.1 and earlier, other file operation events were ignored, allowing any locally running process to read or modify files regardless of the configured policies. This violates the intended confidentiality and integrity controls for protected files and can be exploited by a local user to bypass the Access Policy Enforcement (FAA) mechanism.

The affected vendor is ClearanceKit, with products on the 4.1 branch and earlier being vulnerable. All releases on the 4.2 branch include the fix and are no longer affected.

The vulnerability carries a CVSS base score of 8.7, indicating high severity. No EPSS score is provided, and the issue is not listed in CISA’s KEV catalog, but the attack vector requires local process execution, which is likely for any user on the system. An attacker who can run code locally can exploit the bypass to read or modify files protected by ClearanceKit’s FAA policies, potentially escalating privileges and compromising system integrity.