CVE-2026-84587

Permission Issue Allowing Apps to Access Protected User Data

View on CVE.org
Published Sep 14, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Description
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access protected user data.

Analysis

AI-generated

Technical impact

A permissions issue in macOS allows applications to read protected user data that they should not be able to access. This flaw effectively grants an application elevated privileges to sensitive information, leading to potential confidentiality violations. The weakness is an example of improper access control (CWE‑269).

Affected Systems

Apple macOS versions affected include Golden Gate 27, Sequoia 15.8, and Tahoe 26.7. Newer releases are not mentioned.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of < 1% shows a low probability of exploitation. This vulnerability is not listed in the CISA KEV catalog. An attacker who can install or run a malicious application on the target system might exploit the permission lapse to read protected user data. The likely attack vector is local, as it requires legitimate execution of the app on the machine.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade macOS to the latest security‑patched release, specifically Golden Gate 27 or later, Sequoia 15.8 or later, or Tahoe 26.7 or later.
  • Restrict permissions for applications that are not required to access protected data, reviewing the app settings and revoking unnecessary access.
  • Enable and review system‑wide privacy controls, ensuring that only approved applications have read access to sensitive user information.
  • Monitor system logs for signs of unauthorized data access and conduct regular audit reviews.

Generated by OpenCVE AI on September 20, 2026 at 19:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Title Permission Issue Allowing Apps to Access Protected User Data
Type Values Removed Values Added
CPEs cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
Type Values Removed Values Added
Weaknesses CWE-269
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Title macOS Permissions Issue Allows App to Access Protected User Data
Weaknesses CWE-284
Type Values Removed Values Added
Title macOS Permissions Issue Allows App to Access Protected User Data
Weaknesses CWE-284
Type Values Removed Values Added
First Time appeared Apple
Apple macos
Vendors & Products Apple
Apple macos
Type Values Removed Values Added
Description A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access protected user data.
References
Earlier changes (2)
Weaknesses
  • CWE-269

    Improper Privilege Management

Sources

Status
PUBLISHED
Assigner
apple
Published
Updated
Oct 26, 2026, 8:39 PM
Reserved
Sep 1, 2026, 9:13 PM

View source JSON

Updated
Sep 17, 2026, 3:05 PM

JSON

Status
Analyzed
Published
Sep 14, 2026, 9:17 PM
Modified
Sep 17, 2026, 4:54 PM

View source JSON

No data.

Updated
Sep 20, 2026, 8:00 PM

JSON