CVE-2026-43766

Analyzed Analyzed - Analysis Complete

Authorization Bypass in macOS Allowing Sensitive Data Exposure

Publication date: 2026-07-27

Last updated on: 2026-07-28

Assigner: Apple Inc.

Description

An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An attacker with physical access to a locked device may be able to view sensitive user information.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-27

Last Modified

2026-07-28

Generated

2026-08-17

AI Q&A

2026-07-28

EPSS Evaluated

2026-08-15

NVD

CVE-2026-43766

EUVD

EUVD-2026-49542

Affected Vendors & Products

Vendor	Product	Version / Range
apple	macos	From 14.0 (inc) to 14.8.8 (exc)
apple	macos	From 15.0 (inc) to 15.7.8 (exc)
apple	macos	From 26.0 (inc) to 26.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

This is an authorization issue caused by poor state management in Apple operating systems. It allows an attacker with physical access to a locked device to bypass restrictions and view sensitive user information.

Detection Guidance

This vulnerability requires physical access to a locked device and is related to authorization state management. Detection would involve checking device lock behavior and authorization prompts. No specific commands are provided in the CVE details. Review Apple's security updates for macOS Sequoia 15.7.8, Sonoma 14.8.8, or Tahoe 26.6 to verify if your system is patched.

Impact Analysis

If someone gains physical access to your locked Apple device, they may be able to access private data such as messages, photos, or files without proper authorization.

Compliance Impact

The vulnerability allows an attacker with physical access to a locked device to view sensitive user information. This could potentially lead to unauthorized access to personal data, which may violate compliance requirements under GDPR, HIPAA, or other privacy regulations depending on the data exposed.

Mitigation Strategies

Update to the latest version of macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, or macOS Tahoe 26.6 to address the authorization issue. Ensure physical access to devices is restricted to prevent unauthorized viewing of sensitive information.

Hi! I’m here to help you understand CVE-2026-43766. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70