The flaw lies in residual entitlement information present in macOS system packages, which can be mistakenly granted to applications. This misconfiguration permits an application to request and obtain permissions that it should not possess, allowing it to read user‑sensitive data. The resulting impact is an unauthorized disclosure of private information through legitimate system privileges.

Apple macOS prior to version Golden Gate 27 is affected. The vulnerability stems from remaining, undocumented entitlements bundled in the system, and is remedied by installing macOS Golden Gate 27 or later where the unnecessary entitlements have been removed. Users who rely on older releases are exposed to potential unauthorized data access.

The EPSS score is < 1%, indicating a very low but non-zero exploitation probability. The CVSS score of 5.5 signals a moderate confidentiality risk. The vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector is a locally running application that already has some level of system access and exploits the superfluous entitlements to read protected data. This inference is drawn from the fact that the issue is resolved by removing entitlements, implying that exploitation would require the application to leverage a privilege that was originally granted to it.