VULNERABILITY INTELLIGENCE

CVE-2026-40599

CVSS score7.1 HIGH
EPSS probability0.13%
CISA KEVNot currently listed
Published2026-04-21
Last modified2026-10-26
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Description

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to 5.0.5, ClearanceKit incorrectly treats a process with an empty Team ID and a non-empty Signing ID as an Apple platform binary. This bug allows a malicious software to impersonate an apple process in the global allowlist, and access all protected files. This vulnerability is fixed in 5.0.5.

Weakness classification

  • security-advisories@github.com: CWE-863

Primary references