ClearanceKit is a macOS file‑system access monitoring tool that enforces per‑process file access policies. It contains an operation‑filter system extension that intercepts file operation events. Prior to version 4.2.4, the extension did not handle the ES_EVENT_TYPE_AUTH_EXCHANGEDATA and ES_EVENT_TYPE_AUTH_CLONE event types. A local process able to use these events could therefore perform file operations that bypass the intended policy checks, allowing unauthorized read, write, or execution of files. This constitutes an authorization bypass, potentially exposing sensitive files or facilitating further local privilege escalation.

The vulnerability affects the CIA software ClearanceKit, developed by craigjbass, on macOS platforms. Any installation of ClearanceKit before v4.2.4 is susceptible, irrespective of specific minor release numbers. All lower versions lack subscription to the two missing event types, and thus are exposed.

The CVSS base score of 8.4 indicates a high severity. The absence of an EPSS score means we cannot estimate current exploitation likelihood, but the vulnerability is marked as not included in CISA's KEV catalog. The exploit requires a local macro or running code against ClearanceKit, so the likely attack vector is local. The vulnerability has been patched in the public commit 6181c4a, so systems that upgrade mitigate the risk.