CVE-2026-28845: Apple macOS Authorization Bypass Flaw

CVE-2026-28845 Overview

CVE-2026-28845 is an authorization bypass vulnerability affecting Apple macOS that stems from improper state management within the operating system's security framework. This vulnerability allows a malicious application to bypass access controls and gain unauthorized access to protected user data, potentially compromising sensitive information stored on affected systems.

Critical Impact

A malicious application can exploit improper state management to access protected user data without proper authorization, potentially exposing sensitive personal information.

Affected Products

• Apple macOS (versions prior to macOS Tahoe 26.4)

Discovery Timeline

• 2026-03-25 - CVE-2026-28845 published to NVD
• 2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-28845

Vulnerability Analysis

CVE-2026-28845 represents an authorization bypass vulnerability classified under CWE-285 (Improper Authorization). The flaw exists in the state management mechanism that governs access control decisions within macOS. When applications request access to protected user data, the operating system's authorization framework fails to properly maintain and validate the authorization state, creating an opportunity for unauthorized data access.

This vulnerability requires local access to the target system, meaning an attacker would need to deploy a malicious application on the victim's machine. Once executed, the application can leverage the state management flaw to circumvent normal authorization checks and access data that should be restricted, including potentially sensitive user files and information protected by macOS security mechanisms.

Root Cause

The root cause of this vulnerability lies in improper state management within the macOS authorization framework. The operating system fails to correctly track and enforce authorization states during application data access requests, leading to a condition where authorization checks can be bypassed. Apple addressed this issue by implementing improved state management to ensure proper authorization validation throughout the access control process.

Attack Vector

The attack vector for CVE-2026-28845 is local, requiring an attacker to execute a malicious application on the target macOS system. This could be achieved through:

1. Social Engineering: Convincing users to download and execute a malicious application disguised as legitimate software
2. Supply Chain Compromise: Injecting malicious code into trusted applications or software distribution channels
3. Existing System Access: Leveraging prior access to install a custom application that exploits the vulnerability

Once the malicious application is running with user interaction, it can exploit the authorization state management flaw to access protected user data without triggering normal permission prompts or authorization checks.

The vulnerability mechanism involves improper state handling in the authorization framework. When an application requests access to protected resources, the system should verify authorization state consistently throughout the request lifecycle. Due to the state management flaw, these checks can be circumvented, allowing unauthorized data access. See the Apple Security Advisory for complete technical details.

Detection Methods for CVE-2026-28845

Indicators of Compromise

• Unexpected applications accessing protected user data directories such as Documents, Photos, or Mail without prior authorization
• Unusual file access patterns from applications that should not have data access permissions
• Applications bypassing macOS Transparency, Consent, and Control (TCC) framework prompts

Detection Strategies

• Monitor TCC database (~/Library/Application Support/com.apple.TCC/TCC.db) for unauthorized permission entries
• Review system logs for applications accessing protected data without corresponding TCC authorization records
• Implement endpoint detection rules to identify applications reading protected user data directories without proper entitlements

Monitoring Recommendations

• Enable detailed file access auditing on sensitive user data directories
• Monitor for applications executing with unusual entitlement profiles or accessing data outside their expected scope
• Deploy endpoint detection and response (EDR) solutions capable of identifying authorization bypass attempts

How to Mitigate CVE-2026-28845

Immediate Actions Required

• Update all affected macOS systems to macOS Tahoe 26.4 or later immediately
• Review installed applications and remove any untrusted or suspicious software
• Audit recent file access logs for potential unauthorized data access
• Enable additional application access restrictions through System Settings > Privacy & Security

Patch Information

Apple has released macOS Tahoe 26.4 which addresses this vulnerability through improved state management in the authorization framework. System administrators and users should apply this update as soon as possible. Detailed patch information is available in the Apple Security Advisory.

Workarounds

• Restrict application installation to only verified applications from the Mac App Store or identified developers
• Enable Lockdown Mode for high-risk users requiring additional protection against sophisticated attacks
• Review and limit application permissions in System Settings > Privacy & Security > Files and Folders

# Verify current macOS version to ensure patch is applied
sw_vers -productVersion

# Review TCC database for unexpected application permissions
sqlite3 ~/Library/Application\ Support/com.apple.TCC/TCC.db "SELECT client, service FROM access WHERE allowed=1;"

# Enable stricter Gatekeeper settings
sudo spctl --master-enable