{"id":"CVE-2026-86932","kind":"vulnerability","aliases":["CVE-2026-86932"],"related":[],"title":"macOS: authorization flaw lets an app access sensitive user data","description":"An authorization issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. An app may be able to access sensitive user data.","summary":"An authorization issue in macOS lets a local app reach sensitive user data it should not be able to read. The sources say the fix is in macOS Golden Gate 27 and give no further technical detail.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple-devices","infrastructure","macos"],"not_affected_if":["already-on-golden-gate-27"],"how_to_check":"- Check the macOS version under Apple menu > About This Mac or with `sw_vers -productVersion`\n- unknown for anything beyond the version, the sources do not say which data or setting is involved","fix":"- Update macOS to Golden Gate 27 or later via System Settings > General > Software Update\n- unknown for any interim workaround, the sources do not say","status":"open","published_at":"2026-10-20T01:17:27+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-25T04:12:36+00:00","updated_at":"2026-10-25T04:12:36+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T04:12:36Z","model":"claude-haiku-5-5","output":{"fix":"- Update macOS to Golden Gate 27 or later via System Settings > General > Software Update\n- unknown for any interim workaround, the sources do not say","reach":"local","title":"macOS: authorization flaw lets an app access sensitive user data","impact":"medium","summary":"An authorization issue in macOS lets a local app reach sensitive user data it should not be able to read. The sources say the fix is in macOS Golden Gate 27 and give no further technical detail.","category":"infrastructure","nicknames":[],"who_cares":["macos","apple-devices"],"confidence":0.5,"needs_auth":"unknown","worst_case":"a local app reads sensitive user data it should not access","analyst_note":"Find Apple's security content page for the Golden Gate 27 release to confirm affected builds, the data involved, and the exact prerequisites.","how_to_check":"- Check the macOS version under Apple menu > About This Mac or with `sw_vers -productVersion`\n- unknown for anything beyond the version, the sources do not say which data or setting is involved","needs_analyst":true,"not_affected_if":["already-on-golden-gate-27"],"who_is_affected":"Macs running a macOS release older than Golden Gate 27 are affected, as the sources say the issue is fixed in that release. The sources do not say which apps or data paths trigger it, so the exposure for a given machine is unknown. Systems already on Golden Gate 27 or later are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000592,"input_tokens":3245,"output_tokens":535,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-86932':13A,16A '27':52B,76C 'abl':39B,81C 'access':7A,83C 'address':63C 'app':6A,30B,78C 'appl':18B 'apple-devic':17B 'author':2A,23B,60C 'cve':11A,14A 'data':10A,34B,86C 'detail':58B 'devic':19B 'fix':46B,71C 'flaw':3A 'gate':51B,75C 'give':54B 'golden':50B,74C 'improv':65C 'infrastructur':20B 'issu':24B,61C,69C 'let':4A,27B 'local':29B 'maco':1A,21B,26B,49B,73C 'manag':67C 'may':79C 'reach':31B 'read':41B 'say':44B 'sensit':8A,32B,84C 'sourc':43B 'state':66C 'technic':57B 'user':9A,33B,85C","nicknames":[],"mitigations":[],"who_affected":"Macs running a macOS release older than Golden Gate 27 are affected, as the sources say the issue is fixed in that release. The sources do not say which apps or data paths trigger it, so the exposure for a given machine is unknown. Systems already on Golden Gate 27 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T01:17:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86932","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86932","severity":null,"published_at":"2026-10-20T01:17:27+00:00","modified_at":"2026-10-20T15:03:59+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}