---
id: "CVE-2026-112551"
kind: "vulnerability"
aliases: ["CVE-2026-112551"]
title: "Apple macOS: authorization flaw lets an app read sensitive location data"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["apple", "endpoints", "infrastructure", "macos"]
not_affected_if: ["already-patched"]
published_at: "2026-10-26T21:17:48+00:00"
first_seen_at: "2026-10-26T21:20:27+00:00"
updated_at: "2026-10-26T21:28:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112551", "first_seen_at": "2026-10-26T21:20:27+00:00"}]
---

# Apple macOS: authorization flaw lets an app read sensitive location data

An authorization check in macOS was fixed with improved state management. A malicious or compromised app on a Mac can read sensitive location information it should not be able to access.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `sw_vers -productVersion` and compare against the fixed builds: `27.2` for macOS Golden Gate, `26.7.2` for macOS Tahoe
- Check the Location Services list in System Settings > Privacy & Security for apps you do not recognize

## Fix

- Update macOS to `27.2` (Golden Gate) or `26.7.2` (Tahoe) via Software Update
- Revoke Location Services access for apps that do not need it

## Timeline

- 2026-10-26T21:20:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112551

## From the sources

An authorization issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27.2, macOS Tahoe 26.7.2. An app may be able to read sensitive location information.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_