Description
A privacy issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27. An app may be able to access sensitive user data.
Published: 2026-10-20
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Access
Action: Upgrade
AI Analysis

Impact

A privacy issue was identified that allows an application to access sensitive user data due to insufficient checks. The issue is remedied by updated internal validation routines, preventing the app from leaking or reading private information.

Affected Systems

Apple macOS is affected, with all releases prior to macOS Golden Gate 27 being vulnerable. Version 27 and later contain the fix that restores proper access control over sensitive data.

Risk and Exploitability

Exploit potential is present in older macOS builds where an application can obtain data it should not see. The EPSS score of <1% suggests low exploitation probability, and the issue is not listed in the CISA KEV catalog. The CVSS score of 5.5 indicates moderate severity, but because the flaw permits unauthorized data exposure, it can have significant privacy and compliance implications.

Generated by OpenCVE AI on October 20, 2026 at 18:47 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update macOS to version 27 or later, which contains the remediation to enforce proper privacy checks.
  • If an update is not immediately possible, restrict app permissions and disable any that grant unnecessary access to sensitive data.
  • Use system monitoring tools to detect unusual data access patterns and investigate any strange application behavior.

Generated by OpenCVE AI on October 20, 2026 at 18:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://support.apple.com/en-us/149035 cve-icon cve-icon
History

Thu, 29 Oct 2026 18:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

Tue, 20 Oct 2026 19:15:00 +0000

Type Values Removed Values Added
Title Privacy Vulnerability Enabling Unauthorized Access to Sensitive User Data in macOS

Tue, 20 Oct 2026 16:45:00 +0000

Type Values Removed Values Added
Title Privacy Leak from Improper Access Control in macOS Versions Before 27
Weaknesses CWE-284

Tue, 20 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
Title Privacy Leak from Improper Access Control in macOS Versions Before 27
Weaknesses CWE-200
CWE-284
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 20 Oct 2026 04:00:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Vendors & Products Apple
Apple macos

Tue, 20 Oct 2026 01:15:00 +0000

Type Values Removed Values Added
Description A privacy issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27. An app may be able to access sensitive user data.
References

Subscriptions

Apple Macos
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-10-26T20:38:48.298Z

Reserved: 2026-09-08T16:43:47.663Z

Link: CVE-2026-86979

cve-icon Vulnrichment

Updated: 2026-10-20T10:20:43.945Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T01:17:29.450

Modified: 2026-10-29T18:26:37.613

Link: CVE-2026-86979

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T19:00:16Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor