Description
An authorization issue was addressed with improved access control. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access sensitive user data.
Published: 2026-09-14
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Access to Sensitive User Data
Action: Apply Patch
AI Analysis

Impact

An authorization flaw in macOS permits applications to read sensitive user data beyond the intended scope. The vulnerability allows an untrusted or malicious application to access data that should be restricted, leading to a direct breach of confidentiality.

Affected Systems

Apple macOS versions released before Golden Gate 27, Sequoia 15.8, and Tahoe 26.7 are impacted. Users running earlier releases are at risk; upgrading to the specified cutoff versions or later protects against the flaw.

Risk and Exploitability

The EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed exploitation yet. Attackers would likely need to deliver or install a malicious application on the affected macOS system, implying a local or compromised application vector.

Generated by OpenCVE AI on September 20, 2026 at 21:16 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade macOS to Golden Gate 27, Sequoia 15.8, or Tahoe 26.7 and apply any available Apple security updates.
  • If an upgrade cannot be performed immediately, restrict or remove permissions for untrusted applications to minimize exposure.
  • Monitor system logs and application behavior for signs of unauthorized data access.
  • Check Apple’s support resources regularly for new updates that address this issue.

Generated by OpenCVE AI on September 20, 2026 at 21:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 20 Sep 2026 21:45:00 +0000

Type Values Removed Values Added
Title Authorization flaw could expose sensitive user data on macOS

Thu, 17 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-285

Wed, 16 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses NVD-CWE-noinfo
CPEs cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 16 Sep 2026 13:15:00 +0000

Type Values Removed Values Added
Title macOS Authorization Flaw Exposing Sensitive User Data
Weaknesses CWE-285

Tue, 15 Sep 2026 12:30:00 +0000

Type Values Removed Values Added
Title macOS Authorization Flaw Exposing Sensitive User Data
Weaknesses CWE-285

Tue, 15 Sep 2026 02:30:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Vendors & Products Apple
Apple macos

Mon, 14 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
Description An authorization issue was addressed with improved access control. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access sensitive user data.
References

Subscriptions

Apple Macos
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-09-17T14:57:35.000Z

Reserved: 2026-09-01T21:13:17.753Z

Link: CVE-2026-84556

cve-icon Vulnrichment

Updated: 2026-09-16T13:36:39.775Z

cve-icon NVD

Status : Modified

Published: 2026-09-14T21:17:31.760

Modified: 2026-09-17T15:16:53.970

Link: CVE-2026-84556

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T21:30:06Z

Weaknesses