Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2026-40599 Details

Description

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to 5.0.5, ClearanceKit incorrectly treats a process with an empty Team ID and a non-empty Signing ID as an Apple platform binary. This bug allows a malicious software to impersonate an apple process in the global allowlist, and access all protected files. This vulnerability is fixed in 5.0.5.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:7.1 HIGHVector:CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://github.com/craigjbass/clearancekit/security/advisories/GHSA-w253-42qp-5f2x CISA-ADPExploitVendor Advisory
https://github.com/craigjbass/clearancekit/security/advisories/GHSA-w253-42qp-5f2x [email protected]ExploitVendor Advisory

Weakness Enumeration

CWE-IDCWE NameSource
CWE-863Incorrect Authorization[email protected]

Affected Products

ProductVersions
craigjbass clearancekit
< 5.0.5

CPE

  • cpe:2.3:a:craigjbass:clearancekit:*:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.
apple macos
All versions

CPE

  • cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

5 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2026-40599
NVD Published Date:
Apr 21, 2026
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]
CVE-2026-40599 Details - Not Deferred