{"id":"CVE-2026-86933","kind":"vulnerability","aliases":["CVE-2026-86933"],"related":[],"title":"Apple macOS: sandbox permissions flaw exposed user contact information to apps","description":"A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Golden Gate 27. An app may be able to access information about a user's contacts.","summary":"A permissions issue in macOS let an app read information about the user's contacts, and Apple fixed it by adding sandbox restrictions. The sources do not describe the exact code path involved.","severity":"low","cvss":3.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple","endpoint","macos","other"],"not_affected_if":["macos-golden-gate-27-or-later"],"how_to_check":"- Check the macOS version with `sw_vers`, then compare it against the fixed release named by Apple (macOS Golden Gate 27).","fix":"- Update macOS to Golden Gate 27 or later, as named in the NVD entry.","status":"open","published_at":"2026-10-20T01:17:27+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-25T04:46:08+00:00","updated_at":"2026-10-25T04:46:08+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-25T04:46:08Z","model":"claude-haiku-5-5","output":{"fix":"- Update macOS to Golden Gate 27 or later, as named in the NVD entry.","reach":"local","title":"Apple macOS: sandbox permissions flaw exposed user contact information to apps","impact":"low","summary":"A permissions issue in macOS let an app read information about the user's contacts, and Apple fixed it by adding sandbox restrictions. The sources do not describe the exact code path involved.","category":"other","nicknames":[],"who_cares":["macos","apple","endpoint"],"confidence":0.5,"needs_auth":"no","worst_case":"A local app reads contact information it should not access","analyst_note":"Confirm the affected macOS version range and whether any user interaction or app install is needed, using Apple's security release notes for Golden Gate 27.","how_to_check":"- Check the macOS version with `sw_vers`, then compare it against the fixed release named by Apple (macOS Golden Gate 27).","needs_analyst":true,"not_affected_if":["macos-golden-gate-27-or-later"],"who_is_affected":"Mac users and teams running macOS releases before Golden Gate 27 are exposed, and any app installed on those machines could reach contact data. Teams whose Macs are already on Golden Gate 27 or later can skip it. The sources do not say which macOS versions are affected beyond the fix.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000572,"input_tokens":3258,"output_tokens":493,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-86933':14A,17A '27':71C 'abl':76C 'access':78C 'add':41B 'addit':60C 'address':58C 'app':11A,28B,73C 'appl':1A,18B,37B 'code':51B 'contact':8A,35B,84C 'cve':12A,15A 'describ':48B 'endpoint':19B 'exact':50B 'expos':6A 'fix':38B,66C 'flaw':5A 'gate':70C 'golden':69C 'inform':9A,30B,79C 'involv':53B 'issu':23B,56C,64C 'let':26B 'maco':2A,20B,25B,68C 'may':74C 'path':52B 'permiss':4A,22B,55C 'read':29B 'restrict':43B,62C 'sandbox':3A,42B,61C 'sourc':45B 'user':7A,33B,82C","nicknames":[],"mitigations":[],"who_affected":"Mac users and teams running macOS releases before Golden Gate 27 are exposed, and any app installed on those machines could reach contact data. Teams whose Macs are already on Golden Gate 27 or later can skip it. The sources do not say which macOS versions are affected beyond the fix.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T01:17:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86933","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86933","severity":null,"published_at":"2026-10-20T01:17:27+00:00","modified_at":"2026-10-20T15:17:35+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}