CVE-2025-43414CWE-284broken-access-control

CVE-2025-43414

Medium · published November 4, 2025

CVSS v3.1

6.2

EPSS

Percentile

12.4

In the wild

Unconfirmed

What it is

A permissions issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. A shortcut may be able to access files that are normally inaccessible to the Shortcuts app.

The record

Technical detail

CVSS v3.1: 6.2 · MEDIUM
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00224 · 12.4th percentile
Weakness: CWE-284 · Improper Access Control
Published: 2025-11-04T07:15Z

Affected products (2)

Product	Versions	Fixed in
apple/macos	< 14.8.2	14.8.2
apple/macos	≥ 15.0, < 15.7.2	15.7.2

References (3)

https://support.apple.com/en-us/125634 · [email protected]https://support.apple.com/en-us/125635 · [email protected]https://support.apple.com/en-us/125636 · [email protected]

EPSS history

Timeline

04 NOV 01:16Z
A permissions issue was addressed with improved validation
cvelistv5