CVE-2024-40858
Published: 02 April 2026
Summary
CVE-2024-40858 is a high-severity Improper Access Control (CWE-284) vulnerability in Apple Macos. Its CVSS base score is 7.1 (High).
Operationally, ranked at the 21.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and CM-11 (User-installed Software).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the specific permissions flaw by requiring patching to macOS Sequoia 15.1, preventing unauthorized Contacts access.
Enforces approved authorizations and restrictions on app access to sensitive resources like Contacts data, addressing the improper access control vulnerability.
Prohibits or restricts user-installed software, blocking the installation of malicious apps that exploit the permissions bypass.
NVD Description
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.1. An app may be able to access Contacts without user consent.
Deeper analysisAI
CVE-2024-40858 is a permissions vulnerability in macOS that allows an app to access the Contacts data without user consent. The issue stems from insufficient restrictions on app permissions and affects macOS versions prior to Sequoia 15.1. It is classified under CWE-284 (Improper Access Control) with a CVSS v3.1 base score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), indicating high confidentiality and integrity impacts but no availability disruption.
A local attacker with low privileges, such as a malicious app installed by the user, can exploit this vulnerability with low complexity and no user interaction required. Successful exploitation enables unauthorized access to sensitive Contacts information, potentially allowing data exfiltration or manipulation without alerting the user.
Apple addressed this issue in macOS Sequoia 15.1 by implementing additional restrictions on permissions. Security practitioners should advise users to update to the patched version, with further details available in Apple's security advisory at https://support.apple.com/en-us/121564.
Details
- CWE(s)