CVE-2026-33632
Bypass of File Access Policies in ClearanceKit via Unfiltered Event Types
Publication date: 2026-03-26
Last updated on: 2026-04-21
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| craigjbass | clearancekit | to 4.2.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-33632 is a high-severity vulnerability in ClearanceKit's opfilter system extension versions up to 4.2.3 on macOS. The vulnerability exists because two file operation event types—ES_EVENT_TYPE_AUTH_EXCHANGEDATA and ES_EVENT_TYPE_AUTH_CLONE—were not intercepted by the system, allowing local processes with low privileges to bypass file access policies.
The EXCHANGEDATA event allows an attacker to atomically swap the data fork of a protected file with an attacker-controlled file using the legacy exchangedata(2) syscall, replacing the contents without triggering usual file operation events like RENAME, UNLINK, CREATE, or TRUNCATE.
The CLONE event enables creating a copy-on-write clone of a protected file to an unprotected path without triggering OPEN or COPYFILE events. Both these operations circumvent the existing policy enforcement, compromising the system's confidentiality and integrity.
This vulnerability affects both management-deployed and user-configured rules equally and was patched in ClearanceKit version 4.2.4 by subscribing the system extension to these two event types and routing them through the policy evaluator.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows local attackers with low privileges to bypass file access policies and modify protected files or create unauthorized clones without detection, compromising the confidentiality and integrity of the system.
Such unauthorized access and modification of protected files can lead to violations of data protection requirements in common standards and regulations like GDPR and HIPAA, which mandate strict controls over access to sensitive data to ensure confidentiality and integrity.
Therefore, if ClearanceKit is used as part of an organization's data protection controls, this vulnerability could undermine compliance efforts by allowing unauthorized data manipulation and access.
How can this vulnerability impact me? :
This vulnerability allows local attackers with low privileges to bypass file access policies and modify the contents of protected files or create unauthorized clones without detection.
As a result, the confidentiality and integrity of protected files can be compromised, potentially leading to unauthorized data modification or leakage.
The impact on availability is low, but the high impact on confidentiality and integrity means sensitive data could be exposed or altered without proper authorization.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves two specific macOS Endpoint Security events: ES_EVENT_TYPE_AUTH_EXCHANGEDATA and ES_EVENT_TYPE_AUTH_CLONE, which were previously not monitored by ClearanceKit's opfilter system extension.
Detection involves monitoring these two event types to identify attempts to bypass file access policies by swapping file data or cloning protected files.
Since ClearanceKit version 4.2.4 subscribes to these events and routes them through the policy evaluator, upgrading and reactivating the system extension enables detection.
While specific commands are not provided in the resources, monitoring macOS Endpoint Security events related to AUTH_EXCHANGEDATA and AUTH_CLONE can be done using system diagnostic tools or custom scripts that listen for these ES events.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade ClearanceKit to version 4.2.4 or later, which includes the patch subscribing to the previously unmonitored ES_EVENT_TYPE_AUTH_EXCHANGEDATA and ES_EVENT_TYPE_AUTH_CLONE events.
After upgrading, users must reactivate the ClearanceKit system extension to ensure the new event subscriptions are active and the policy evaluator can enforce access controls on these file operations.