CVE-2026-40191

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to 5.0.4-beta-1f46165, ClearanceKit's Endpoint Security event handler only checked the source path of dual-path file operations against File Access Authorization (FAA) rules and App Jail policies. The destination path was ignored entirely. This allowed any local process to bypass file-access protection by using rename, link, copyfile, exchangedata, or clone operations to place or replace files inside protected directories. This vulnerability is fixed in 5.0.4-beta-1f46165.

CVSS

No CVSS.

References

Link	Resource
https://github.com/craigjbass/clearancekit/releases/tag/v5.0.4-1f46165
https://github.com/craigjbass/clearancekit/security/advisories/GHSA-92f3-38m7-579h

Configurations

No configuration.

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) ClearanceKit intercepta eventos de acceso al sistema de archivos en macOS y aplica políticas de acceso por proceso. Antes de 5.0.4-beta-1f46165, el gestor de eventos de seguridad de punto final de ClearanceKit solo verificaba la ruta de origen de las operaciones de archivo de doble ruta contra las reglas de Autorización de Acceso a Archivos (FAA) y las políticas de App Jail. La ruta de destino se ignoraba por completo. Esto permitía a cualquier proceso local eludir la protección de acceso a archivos mediante el uso de operaciones de renombrar, enlazar, copiar archivo, intercambiar datos o clonar para colocar o reemplazar archivos dentro de directorios protegidos. Esta vulnerabilidad está corregida en 5.0.4-beta-1f46165.

Information

Published : 2026-04-10 21:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-40191

Mitre link : CVE-2026-40191

CVE.ORG link : CVE-2026-40191

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-40191", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40191", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-15T15:10:53.252092Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.8, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "craigjbass", "product": "clearancekit", "versions": [{"status": "affected", "version": "< 5.0.4-beta-1f46165"}]}]}], "published": "2026-04-10T21:16:27.440", "references": [{"url": "https://github.com/craigjbass/clearancekit/releases/tag/v5.0.4-1f46165", "source": "security-advisories@github.com"}, {"url": "https://github.com/craigjbass/clearancekit/security/advisories/GHSA-92f3-38m7-579h", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to 5.0.4-beta-1f46165, ClearanceKit's Endpoint Security event handler only checked the source path of dual-path file operations against File Access Authorization (FAA) rules and App Jail policies. The destination path was ignored entirely. This allowed any local process to bypass file-access protection by using rename, link, copyfile, exchangedata, or clone operations to place or replace files inside protected directories. This vulnerability is fixed in 5.0.4-beta-1f46165."}, {"lang": "es", "value": "ClearanceKit intercepta eventos de acceso al sistema de archivos en macOS y aplica pol\u00edticas de acceso por proceso. Antes de 5.0.4-beta-1f46165, el gestor de eventos de seguridad de punto final de ClearanceKit solo verificaba la ruta de origen de las operaciones de archivo de doble ruta contra las reglas de Autorizaci\u00f3n de Acceso a Archivos (FAA) y las pol\u00edticas de App Jail. La ruta de destino se ignoraba por completo. Esto permit\u00eda a cualquier proceso local eludir la protecci\u00f3n de acceso a archivos mediante el uso de operaciones de renombrar, enlazar, copiar archivo, intercambiar datos o clonar para colocar o reemplazar archivos dentro de directorios protegidos. Esta vulnerabilidad est\u00e1 corregida en 5.0.4-beta-1f46165."}], "lastModified": "2026-10-26T21:10:00.170", "sourceIdentifier": "security-advisories@github.com"}