An authorization flaw in macOS allows a locally running application to access otherwise protected user data due to improper state management. The issue corresponds to improper authorization (CWE-285). An attacker can read sensitive personal information that should be restricted to an authorized context, potentially exposing confidential data to the malicious application.

Apple macOS operating systems are impacted when running a version prior to the releases that contain the fix. The flaw was resolved in macOS Sequoia 15.7.8 and macOS Tahoe 26.6, so any machine running an earlier build is vulnerable.

The CVSS score of 5.5 indicates a moderate severity vulnerability. The EPSS score is less than 1%, showing a low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description and available references, the likely attack vector is local: an attacker would need to install or execute a malicious application on the system to benefit from the authorization bypass and read sensitive data.