CVE-2026-43766 | An authorization issue was addressed with improved state man… | CVSS 4.6 MEDIUM

Description

An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An attacker with physical access to a locked device may be able to view sensitive user information.

Metadata

CVE ID: CVE-2026-43766
State: PUBLISHED
Assigner: apple
Reserved: 2026-05-01 22:46 UTC
Published: 2026-07-27 20:13 UTC
Last updated: 2026-07-28 15:54 UTC
Primary CWE: CWE-287
CWE-287 Improper Authentication
Vendor / Product: Apple / macOS
Sources: cve.org · NVD

Severity & Metrics

4.6 MEDIUM CVSS 3.1

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
Apple	macOS	—	0 < 14.8.8, 0 < 15.7.8, 0 < 26.6

Weakness (CWE)

CWE	Source	Description
—	cna	An attacker with physical access to a locked device may be able to view sensitive user information
CWE-287	adp	CWE-287 Improper Authentication

CVSS scores (1)

Score	Severity	Version	Source	Vector
4.6	MEDIUM	3.1	adp	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References (3)