An access restriction weakness was discovered in macOS that permits an application to read or otherwise interact with user‑sensitive data beyond its intended scope. The flaw stems from insufficient authorization checks, allowing a malicious or compromised app to bypass normal sandbox boundaries and retrieve protected information. While the vulnerability does not enable arbitrary code execution, it does compromise data confidentiality.

Apple macOS systems running versions prior to Sonoma 14.8.8 or Tahoe 26.6 are affected. The issue is fixed in those releases, so any machine still on an earlier patch level remains vulnerable. The description specifically references macOS as the impacted product.

The flaw carries a CVSS score of 8.6, indicating a high severity. An EPSS score of less than 1% suggests limited exploitation probability in the wild. The vulnerability falls under the access control family (CWE-284). Attackers can gain unauthorized access to user‑sensitive data by exploiting insufficient authorization checks in macOS, as demonstrated in the mentioned security advisory. Because the flaw does not allow remote code execution, its impact is confined to data confidentiality, but the high severity and lack of KEV listing mean it is a significant risk for devices that remain on older macOS releases.