CVE-2026-43792

Awaiting Analysis Awaiting Analysis - Queue

Improper Authorization in Safari and macOS Tahoe

Publication date: 2026-07-27

Last updated on: 2026-07-29

Assigner: Apple Inc.

Description

An authorization issue was addressed with improved state management. This issue is fixed in Safari 26.6, macOS Tahoe 26.6. An app may be able to access sensitive user data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-27

Last Modified

2026-07-29

Generated

2026-08-17

AI Q&A

2026-07-28

EPSS Evaluated

2026-08-15

NVD

CVE-2026-43792

EUVD

EUVD-2026-49558

Affected Vendors & Products

Vendor	Product	Version / Range
apple	macos	From 26.0 (inc) to 26.6 (exc)
apple	safari	to 26.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This is an authorization issue caused by poor state management in Safari and macOS Tahoe. It allows an app to potentially access sensitive user data without proper permissions.

Detection Guidance

This vulnerability is specific to Safari 26.6 and macOS Tahoe 26.6, so detection involves checking installed versions of these software. For Safari, check the version via 'defaults read /Applications/Safari.app/Contents/Info.plist CFBundleVersion' on macOS. For macOS Tahoe, run 'sw_vers -productVersion'. Ensure you are running the patched versions (26.6 or later).

Impact Analysis

If exploited, this vulnerability could let malicious apps access your private information like passwords, messages, or files without your consent. It compromises user data privacy.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating GDPR's data protection principles and HIPAA's security rules for protected health information.

Mitigation Strategies

Update Safari to version 26.6 and macOS Tahoe to version 26.6 to address the authorization issue.

Hi! I’m here to help you understand CVE-2026-43792. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70