Product:
macOS Sequoia
Summary
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.1. An app may be able to access Contacts without user consent.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.1 | CVE-2024-40858 |
Exploitation
An attacker with local access to the system could exploit this vulnerability by running a malicious application that accesses the Contacts database without the user’s consent. The low complexity of the attack means that it can be executed easily by users with minimal technical skills.
Affected Products
- macOS Sequoia: The latest version addresses the permissions issue but earlier versions are vulnerable.
Mitigation
Users should update to macOS Sequoia 15.1 or later to ensure that the permissions issue is resolved. It is also recommended to review app permissions regularly to prevent unauthorized access to sensitive data.