A local authorization flaw in macOS permits a malicious application to override user‑configured privacy preferences. The vulnerability stems from insufficient state‑management checks, allowing an app to modify privacy settings without the user's consent and potentially expose personal data. This leads to an unintended privilege escalation where the application gains broader rights than intended.

Apple macOS versions prior to the advertised fixes are affected. Specifically, macOS Sequoia before 15.7.8, macOS Sonoma before 14.8.8, and macOS Tahoe before 26.6 are vulnerable. The issue is resolved in the patched releases mentioned.

The CVSS score of 7.1 highlights a moderate to high severity, while the EPSS score of less than 1% indicates a low expected exploitation probability. The vulnerability is not listed in the CISA KEV catalog, implying no documented widespread exploitation. The likely attack vector is a malicious local application that has already acquired the ability to run on the system; such an app can exploit the bypass to modify privacy settings without user awareness.