{"id":"CVE-2026-112617","kind":"vulnerability","aliases":["CVE-2026-112617"],"related":[],"title":"macOS: an app can read sensitive user data, fixed in 27.2","description":"An information disclosure issue was addressed with improved logic. This issue is fixed in macOS Golden Gate 27.2. An app may be able to access sensitive user data.","summary":"Apple's macOS Golden Gate 27.2 fixes an information disclosure flaw that lets an app access sensitive user data. The sources give no product component, trigger, or CVSS score.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple-devices","endpoints","infrastructure","macos"],"not_affected_if":[],"how_to_check":"- Run `sw_vers -productVersion` on each Mac and compare against the fixed release\n- unknown","fix":"- Update macOS to `27.2` or later (Golden Gate)\n- unknown","status":"open","published_at":"2026-10-26T21:17:54+00:00","first_seen_at":"2026-10-26T21:20:28+00:00","triaged_at":"2026-10-26T21:25:23+00:00","updated_at":"2026-10-26T21:25:23+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-26T21:25:23Z","model":"claude-haiku-5-5","output":{"fix":"- Update macOS to `27.2` or later (Golden Gate)\n- unknown","reach":"local","title":"macOS: an app can read sensitive user data, fixed in 27.2","impact":"medium","summary":"Apple's macOS Golden Gate 27.2 fixes an information disclosure flaw that lets an app access sensitive user data. The sources give no product component, trigger, or CVSS score.","category":"infrastructure","nicknames":[],"who_cares":["macos","apple-devices","endpoints"],"confidence":0.4,"needs_auth":"unknown","worst_case":"A local app reads sensitive user data it should not reach","analyst_note":"Check Apple's security notes for macOS 27.2 (Golden Gate) for the component, the CVE entry and any user-interaction or entitlement requirement.","how_to_check":"- Run `sw_vers -productVersion` on each Mac and compare against the fixed release\n- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Macs running macOS Golden Gate builds earlier than 27.2 are affected, since the sources say the fix ships in 27.2. The sources do not say which apps or permissions are needed to trigger the flaw, so unknown whether managed fleets with restricted app installs are exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000568,"input_tokens":3243,"output_tokens":488,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-112617':14A,17A '-2026':13A,16A '27.2':11A,29B,70C 'abl':75C 'access':39B,77C 'address':58C 'app':3A,38B,72C 'appl':19B,24B 'apple-devic':18B 'compon':48B 'cve':12A,15A 'cvss':51B 'data':8A,42B,80C 'devic':20B 'disclosur':33B,55C 'endpoint':21B 'fix':9A,30B,65C 'flaw':34B 'gate':28B,69C 'give':45B 'golden':27B,68C 'improv':60C 'inform':32B,54C 'infrastructur':22B 'issu':56C,63C 'let':36B 'logic':61C 'maco':1A,23B,26B,67C 'may':73C 'product':47B 'read':5A 'score':52B 'sensit':6A,40B,78C 'sourc':44B 'trigger':49B 'user':7A,41B,79C","nicknames":[],"mitigations":[],"who_affected":"Macs running macOS Golden Gate builds earlier than 27.2 are affected, since the sources say the fix ships in 27.2. The sources do not say which apps or permissions are needed to trigger the flaw, so unknown whether managed fleets with restricted app installs are exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:17:54+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112617","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112617","severity":null,"published_at":"2026-10-26T21:17:54+00:00","modified_at":"2026-10-26T21:17:54+00:00","first_seen_at":"2026-10-26T21:20:28+00:00","fetched_at":"2026-10-26T21:20:28+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}