{"id":"CVE-2026-112551","kind":"vulnerability","aliases":["CVE-2026-112551"],"related":[],"title":"Apple macOS: authorization flaw lets an app read sensitive location data","description":"An authorization issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27.2, macOS Tahoe 26.7.2. An app may be able to read sensitive location information.","summary":"An authorization check in macOS was fixed with improved state management. A malicious or compromised app on a Mac can read sensitive location information it should not be able to access.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple","endpoints","infrastructure","macos"],"not_affected_if":["already-patched"],"how_to_check":"- Run `sw_vers -productVersion` and compare against the fixed builds: `27.2` for macOS Golden Gate, `26.7.2` for macOS Tahoe\n- Check the Location Services list in System Settings > Privacy & Security for apps you do not recognize","fix":"- Update macOS to `27.2` (Golden Gate) or `26.7.2` (Tahoe) via Software Update\n- Revoke Location Services access for apps that do not need it","status":"open","published_at":"2026-10-26T21:17:48+00:00","first_seen_at":"2026-10-26T21:20:27+00:00","triaged_at":"2026-10-26T21:28:01+00:00","updated_at":"2026-10-26T21:28:01+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-26T21:28:01Z","model":"claude-haiku-5-5","output":{"fix":"- Update macOS to `27.2` (Golden Gate) or `26.7.2` (Tahoe) via Software Update\n- Revoke Location Services access for apps that do not need it","reach":"local","title":"Apple macOS: authorization flaw lets an app read sensitive location data","impact":"medium","summary":"An authorization check in macOS was fixed with improved state management. A malicious or compromised app on a Mac can read sensitive location information it should not be able to access.","category":"infrastructure","nicknames":[],"who_cares":["macos","apple","endpoints"],"confidence":0.5,"needs_auth":"unknown","worst_case":"A local app reads the device's sensitive location information without permission","analyst_note":"Check Apple's security release notes for CVE-2026-112551 to confirm the exact affected versions and whether a user action or installed app is required.","how_to_check":"- Run `sw_vers -productVersion` and compare against the fixed builds: `27.2` for macOS Golden Gate, `26.7.2` for macOS Tahoe\n- Check the Location Services list in System Settings > Privacy & Security for apps you do not recognize","needs_analyst":true,"not_affected_if":["already-patched"],"who_is_affected":"Any Mac running a macOS version earlier than the fixed releases can be exposed, since the flaw is in the operating system's permission handling. Managed fleets should prioritise laptops and devices that carry location-sensitive apps. Machines already on the fixed builds can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000603,"input_tokens":3254,"output_tokens":556,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-112551':14A,17A '-2026':13A,16A '26.7.2':73C '27.2':70C 'abl':50B,78C 'access':52B 'address':57C 'app':7A,37B,75C 'appl':1A,18B 'author':3A,23B,54C 'check':24B 'compromis':36B 'cve':12A,15A 'data':11A 'endpoint':19B 'fix':28B,65C 'flaw':4A 'gate':69C 'golden':68C 'improv':30B,59C 'inform':45B,83C 'infrastructur':20B 'issu':55C,63C 'let':5A 'locat':10A,44B,82C 'mac':40B 'maco':2A,21B,26B,67C,71C 'malici':34B 'manag':32B,61C 'may':76C 'read':8A,42B,80C 'sensit':9A,43B,81C 'state':31B,60C 'taho':72C","nicknames":[],"mitigations":[],"who_affected":"Any Mac running a macOS version earlier than the fixed releases can be exposed, since the flaw is in the operating system's permission handling. Managed fleets should prioritise laptops and devices that carry location-sensitive apps. Machines already on the fixed builds can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:17:48+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112551","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112551","severity":null,"published_at":"2026-10-26T21:17:48+00:00","modified_at":"2026-10-26T21:17:48+00:00","first_seen_at":"2026-10-26T21:20:27+00:00","fetched_at":"2026-10-26T21:20:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}