CVE-2024-54466: Apple macOS Authorization Bypass Vulnerability

CVE-2024-54466 Overview

CVE-2024-54466 is an authorization vulnerability in Apple macOS affecting the handling of encrypted volumes. A different user on the same system could access an encrypted volume without being prompted for the password. Apple addressed the flaw with improved state management across macOS Sequoia 15.2, macOS Sonoma 14.7.2, and macOS Ventura 13.7.2. The weakness is classified under [CWE-862] Missing Authorization.

Critical Impact
A local secondary user can access a previously unlocked encrypted volume without providing credentials, exposing confidential data stored on that volume.

Affected Products

Apple macOS Ventura versions prior to 13.7.2
Apple macOS Sonoma versions prior to 14.7.2
Apple macOS Sequoia versions prior to 15.2

Discovery Timeline

2024-12-12 - CVE-2024-54466 published to the National Vulnerability Database
2024-12-11 - Apple releases security updates in advisories 121839, 121840, and 121842
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-54466

Vulnerability Analysis

The flaw resides in the macOS volume-mount authorization workflow. After a user unlocks an encrypted volume, the operating system fails to re-evaluate authorization state when a different user account attempts to access the same volume. The result is that the second user gains read access to plaintext data without a password prompt.

Because the issue is scoped to the confidentiality of volume contents and does not modify data or impact system availability, Apple describes the fix as "improved state management." Exploitation does not require code execution or elevated privileges. Any interactive user session capable of reaching the mounted volume is affected.

Root Cause

The root cause is missing authorization ([CWE-862]) tied to stale mount-session state. macOS treated an already-unlocked encrypted volume as accessible without re-verifying that the requesting user was the principal that supplied the decryption key. State was cached per volume rather than per user session.

Attack Vector

Exploitation requires a scenario where more than one user account exists on the same macOS host and an encrypted volume has been unlocked by one of those users. The second account can then browse or read the volume without being challenged for the password. No exploit code is publicly published in Exploit-DB, and the flaw is not listed on the CISA Known Exploited Vulnerabilities catalog.

No verified public exploit code is available for this issue. See the vendor advisories for technical details: Apple Security Advisory 121839, Apple Security Advisory 121840, and Apple Security Advisory 121842.

Detection Methods for CVE-2024-54466

Indicators of Compromise

Access events to files on an encrypted volume originating from a user account that is not the volume owner or the account that unlocked it.
Unified log entries showing volume mount or access operations without a preceding authentication prompt for the accessing user.
Presence of macOS builds earlier than 13.7.2, 14.7.2, or 15.2 on multi-user endpoints.

Detection Strategies

Inventory macOS endpoints and flag hosts running builds older than the patched versions listed in the Apple advisories.
Correlate file-access telemetry on encrypted volumes against the identity of the user who initiated the unlock, and alert when identities diverge.
Review unified log entries for diskarbitrationd and apfs activity that references shared encrypted volumes across multiple session UIDs.

Monitoring Recommendations

Ingest macOS endpoint telemetry into a centralized data lake and query for cross-user access to encrypted APFS or Core Storage volumes.
Baseline expected user-to-volume mappings on shared macOS hosts and alert on deviations.
Track patch compliance for the December 2024 Apple security updates as a recurring metric.

How to Mitigate CVE-2024-54466

Immediate Actions Required

Update affected macOS hosts to macOS Sequoia 15.2, macOS Sonoma 14.7.2, or macOS Ventura 13.7.2 or later.
Audit multi-user macOS systems to identify shared endpoints where encrypted volumes are mounted by more than one account.
Unmount encrypted volumes when the primary user logs out or steps away from the workstation.

Patch Information

Apple published fixes in the December 11, 2024 security updates. Refer to Apple Security Advisory 121839 for macOS Sequoia 15.2, Apple Security Advisory 121840 for macOS Sonoma 14.7.2, and Apple Security Advisory 121842 for macOS Ventura 13.7.2. The vendor describes the remediation as "improved state management" in the volume authorization path.

Workarounds

Restrict interactive logins on macOS hosts that store sensitive encrypted volumes to a single trusted user account.
Manually eject encrypted volumes immediately after use so that the authorization state cannot be reused by another session.
Enforce endpoint configuration profiles that disallow shared user accounts on devices handling regulated data.

bash

# Verify macOS build and eject an encrypted volume after use
sw_vers -productVersion
diskutil list
diskutil eject /Volumes/EncryptedVolumeName