ClearanceKit intercepts file-system access events on macOS and enforces per‑process access policies. A root process can suspend or kill its opfilter Endpoint Security system extension, causing all AUTH events to time out and default to allow. During this period ClearanceKit’s file‑access policy enforcement is silently disabled, letting a privileged process read, write or execute files that should be blocked.

The affected product is ClearanceKit for macOS. Versions prior to 5.0.6 are vulnerable; the specific extension bundle ID is uk.craigbass.clearancekit.opfilter. Any process running as root on the same system can exploit this flaw.

The CVSS score of 8.2 indicates a high severity vulnerability, and although EPSS data is not available, the risk remains significant because any root process can trigger the attack. The flaw is not listed in CISA’s KEV catalog. An attacker with local root privileges can temporarily disable ClearanceKit’s security controls, achieving privileged access to protected files and data.