CVE-2026-40191
Path Validation Bypass in ClearanceKit Enables Unauthorized File Access
Publication date: 2026-04-10
Last updated on: 2026-04-10
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| clearancekit | clearancekit | to 5.0.4-beta-1f46165 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in ClearanceKit versions prior to 5.0.4-beta-1f46165 on macOS. ClearanceKit intercepts file-system access events and enforces access policies per process. However, its Endpoint Security event handler only checked the source path of dual-path file operations against access rules and policies, completely ignoring the destination path.
Because the destination path was not checked, a local process could bypass file-access protections by using operations such as rename, link, copyfile, exchangedata, or clone to place or replace files inside protected directories.
This flaw allowed unauthorized modification or placement of files in protected areas, which was fixed in version 5.0.4-beta-1f46165.
How can this vulnerability impact me? :
This vulnerability can allow a local attacker or process with limited privileges to bypass file-access protections and place or replace files inside directories that are supposed to be protected.
Such unauthorized file modifications could lead to data integrity issues, unauthorized code execution, or compromise of system security by placing malicious files in sensitive locations.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade ClearanceKit to version 5.0.4-beta-1f46165 or later, where the issue has been fixed.