CVE-2025-43184

This issue was addressed by adding an additional prompt for user consent

Critical · published July 29, 2025

CVSS v3.1
9.8
EPSS
1%
Percentile
55.1
In the wild
Unconfirmed
What it is

🚨 A crafty shortcut could sneak past your Shortcuts app settings! This vulnerability lets a shortcut bypass sensitive configurations, potentially giving unauthorized actions a free pass. 🔥 Imagine a restaurant where the chef has a secret menu that can only be accessed with a special password. Now, picture a sneaky diner tricking the waiter into handing them the password without proper authorization—voilà! That's how this shortcut bug creeps in, exploiting a gap in user consent checks. An attacker could exploit this vulnerability to execute potentially harmful actions without the user's explicit approval, leading to unauthorized access and significant data breaches. This could expose sensitive information or even control the system remotely, making it an absolute nightmare for anyone using affected macOS versions.

Put simply

Imagine a restaurant where the chef has a secret menu that can only be accessed with a special password. Now, picture a sneaky diner tricking the waiter into handing them the password without proper authorization—voilà! That's how this shortcut bug creeps in, exploiting a gap in user consent checks. This vulnerability arises from inadequate user consent checks within the Shortcuts app on certain macOS versions, allowing shortcuts to bypass crucial security settings. The weakness exists in how the app validates user permissions, creating a loophole for potential exploitation.

What to do

An attacker could exploit this vulnerability to execute potentially harmful actions without the user's explicit approval, leading to unauthorized access and significant data breaches. This could expose sensitive information or even control the system remotely, making it an absolute nightmare for anyone using affected macOS versions. To mitigate this risk, ensure your system is updated to macOS Sequoia 15.4, Sonoma 14.7.7, or Ventura 13.7.7. It's essential to review your shortcuts and monitor their configurations to ensure no unauthorized actions can occur. Regularly check for updates to stay protected! You've got this! Follow these steps and you'll secure your macOS environment in no time. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00768 · 55.1th percentile
Published
2025-07-29T23:28Z
EPSS history
Timeline
  • 29 JUL 23:28Z
    This issue was addressed by adding an additional prompt for user consent
    cvelistv5