An access control flaw in Apple macOS allows an application to read or otherwise obtain sensitive user data that should be protected. The vulnerability was addressed by improved access controls, implying that earlier versions permitted unauthorized data access. An attacker who can run or trick a local app could exploit this to exfiltrate private information, compromising user privacy and potentially leading to further attacks.

Apple macOS is the affected product. Versions macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7 contain the vulnerability. All installations of these releases are susceptible until the patch is applied.

The CVSS score is 5.5, indicating a moderate severity vulnerability, and the EPSS score of < 1% suggests a very low probability of exploitation. The vulnerability is listed as not in the CISA KEV catalog. It is an improper access control that could be leveraged by any local or privileged application. Because any app could potentially access sensitive data, the risk is moderate to high, but the lack of known exploits and public use data makes the actual threat level uncertain.