CVE-2026-28930: Apple macOS Information Disclosure Flaw

CVE-2026-28930 Overview

CVE-2026-28930 is a permissions issue in Apple macOS that allows an application to access protected user data. Apple addressed the flaw with additional restrictions in macOS Tahoe 26.5. The vulnerability is classified under [CWE-284] Improper Access Control and carries a CVSS 3.1 base score of 7.5. The flaw affects the confidentiality of user data managed by macOS access control mechanisms without requiring user interaction or prior authentication.

Critical Impact

A malicious application running on a vulnerable macOS host can bypass permission boundaries and read protected user data, undermining the platform's Transparency, Consent, and Control (TCC) model.

Affected Products

• Apple macOS versions prior to macOS Tahoe 26.5
• Systems where Apple's permission restrictions were not enforced for the affected component
• Endpoints that have not applied the Apple security update referenced in advisory 127115

Discovery Timeline

• 2026-05-11 - CVE-2026-28930 published to the National Vulnerability Database
• 2026-05-14 - Last updated in NVD database

Technical Details for CVE-2026-28930

Vulnerability Analysis

The vulnerability stems from an improper access control condition [CWE-284] within macOS. According to Apple's advisory, an app may be able to access protected user data that should be gated by the operating system's permission framework. macOS enforces user data protections through TCC, sandbox profiles, and entitlement checks. When these boundaries are not consistently applied, an unprivileged application can read files, metadata, or other resources reserved for explicitly authorized processes.

Apple resolved the issue by adding restrictions to the affected code path in macOS Tahoe 26.5. The fix tightens enforcement so that requests for protected resources are validated against the caller's entitlements and user consent state. The Apple advisory does not publicly enumerate the underlying component, but the impact is limited to confidentiality. Integrity and availability are not affected based on the published CVSS vector.

Root Cause

The root cause is missing or insufficient permission checks in a macOS component that brokers access to user data. The system did not adequately restrict callers, allowing an app context to retrieve protected resources without the consent or entitlements normally required by the platform.

Attack Vector

Exploitation requires an attacker to deliver and run a malicious application on the target macOS system. Once executed, the app invokes the vulnerable interface to read protected user data such as files, application data, or other resources subject to TCC controls. The advisory reports no requirement for elevated privileges or user interaction beyond launching the malicious app.

No public proof-of-concept or in-the-wild exploitation has been reported. The EPSS probability is 0.045%, indicating a low predicted likelihood of exploitation in the near term. Refer to the Apple Support Article for the authoritative description of the fix.

Detection Methods for CVE-2026-28930

Indicators of Compromise

• Unexpected access to files under user home directories, ~/Library, or other TCC-protected paths by applications that lack the corresponding entitlements.
• Unsigned or ad-hoc signed binaries reading protected user data shortly after first execution.
• Outbound network connections following access to sensitive user directories, suggesting exfiltration after data collection.

Detection Strategies

• Inventory macOS endpoints and flag any host running a version earlier than macOS Tahoe 26.5 as exposed to CVE-2026-28930.
• Monitor process telemetry for applications opening files in TCC-protected locations without an approved consent prompt history.
• Correlate application install events with subsequent reads of sensitive user data to identify suspicious behavior chains.

Monitoring Recommendations

• Enable Unified Log collection on macOS endpoints and forward tccd and sandbox-related events to a centralized analytics platform.
• Alert on new or rarely seen binaries that access Contacts, Calendars, Photos, Documents, or Desktop content.
• Track Gatekeeper and notarization decisions to identify execution of unsigned applications that may carry exploit code.

How to Mitigate CVE-2026-28930

Immediate Actions Required

• Update all affected Macs to macOS Tahoe 26.5 or later, as referenced in the Apple Support Article.
• Restrict installation of unsigned or non-notarized applications across the fleet using MDM policy.
• Audit recently installed third-party applications and revoke any unnecessary TCC permissions granted to untrusted apps.

Patch Information

Apple released the fix in macOS Tahoe 26.5. The vendor states the issue was addressed with additional restrictions. Administrators should deploy the update through Apple's Software Update mechanism or an MDM solution such as Jamf, Intune, or Kandji. Confirm patch application by validating the OS build on each endpoint after deployment.

Workarounds

• Limit installation rights so that only administrators can deploy applications on managed Macs until patching is complete.
• Remove or quarantine untrusted applications that request broad access to user data such as Full Disk Access or Files and Folders.
• Enforce least-privilege TCC configurations through MDM profiles to reduce the data exposed if an app attempts to abuse the flaw.

# Verify macOS build and confirm CVE-2026-28930 patch status
sw_vers -productVersion
softwareupdate --list
sudo softwareupdate -i -a --restart