{"id":"CVE-2026-107067","kind":"vulnerability","aliases":["CVE-2026-107067"],"related":[],"title":"SuperDuper! backup app leaks sensitive information to local users","description":"An issue in Shirt Pocket's SuperDuper! 4.0.9 and earlier allow a local attacker to obtain sensitive information","summary":"Shirt Pocket's SuperDuper! 4.0.9 and earlier has an issue that lets a local attacker obtain sensitive information. The sources do not say what data is exposed or how.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["backup","local-users","macos","other"],"not_affected_if":["newer-version"],"how_to_check":"- Check the installed SuperDuper! version in the app's About window or its Info.plist; treat `4.0.9` and earlier as affected.\n- unknown for any further check, since the sources do not describe the flaw.","fix":"- Move SuperDuper! to a version newer than `4.0.9`; the fixed version is unknown from the sources.","status":"open","published_at":"2026-10-27T14:16:32+00:00","first_seen_at":"2026-10-27T14:32:18+00:00","triaged_at":"2026-10-27T14:39:26+00:00","updated_at":"2026-10-27T14:39:26+00:00","category":"other","confidence":0.3,"triage":{"at":"2026-10-27T14:39:26Z","model":"claude-haiku-5-5","output":{"fix":"- Move SuperDuper! to a version newer than `4.0.9`; the fixed version is unknown from the sources.","reach":"local","title":"SuperDuper! backup app leaks sensitive information to local users","impact":"low","summary":"Shirt Pocket's SuperDuper! 4.0.9 and earlier has an issue that lets a local attacker obtain sensitive information. The sources do not say what data is exposed or how.","category":"other","nicknames":[],"who_cares":["macos","backup","local-users"],"confidence":0.3,"needs_auth":"unknown","worst_case":"local attacker reads sensitive information handled by the app","analyst_note":"Find the NVD entry details or vendor advisory for CVE-2026-107067 to learn what data leaks, the affected platform, and the fixed version.","how_to_check":"- Check the installed SuperDuper! version in the app's About window or its Info.plist; treat `4.0.9` and earlier as affected.\n- unknown for any further check, since the sources do not describe the flaw.","needs_analyst":true,"not_affected_if":["newer-version"],"who_is_affected":"Machines running SuperDuper! 4.0.9 or earlier, where another local user or process could read information the app handles. The sources do not say which data or configurations are involved, so the exposure scope is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000574,"input_tokens":3266,"output_tokens":495,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107067':12A,15A '-2026':11A,14A '4.0.9':25B,55C 'allow':58C 'app':3A 'attack':35B,61C 'backup':2A,16B 'cve':10A,13A 'data':45B 'earlier':27B,57C 'expos':47B 'inform':6A,38B,65C 'issu':30B,49C 'leak':4A 'let':32B 'local':8A,18B,34B,60C 'local-us':17B 'maco':20B 'obtain':36B,63C 'pocket':22B,52C 'say':43B 'sensit':5A,37B,64C 'shirt':21B,51C 'sourc':40B 'superdup':1A,24B,54C 'user':9A,19B","nicknames":[],"mitigations":[],"who_affected":"Machines running SuperDuper! 4.0.9 or earlier, where another local user or process could read information the app handles. The sources do not say which data or configurations are involved, so the exposure scope is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107067","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107067","severity":null,"published_at":"2026-10-27T14:16:32+00:00","modified_at":"2026-10-27T14:16:32+00:00","first_seen_at":"2026-10-27T14:32:18+00:00","fetched_at":"2026-10-27T14:32:18+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}