ClearanceKit intercepts file‑system access events on macOS. Prior to version 4.2.14 the opfilter started enforcing only a single compile‑time baseline rule, leaving all MDM‑delivered and user‑defined file‑access policies inactive until the user first interacted with the GUI. This allowed processes to read, write, or delete files outside the intended scope, potentially enabling data theft or manipulation. The weakness is a privilege escalation issue (CWE‑269).

The vulnerability affects the macOS version of ClearanceKit distributed by craigjbass. Any installation prior to version 4.2.14 is affected. The product is used to enforce per‑process file‑system access controls.

The CVSS base score is 6.3, indicating moderate severity. The EPSS score is below 1 %, suggesting a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need local access to a macOS machine running ClearanceKit before the policy is modified, and can exploit the window between service start and first GUI interaction to access files that should be protected.