CVE-2024-40858
Published: 02 April 2026
Summary
CVE-2024-40858 is a high-severity Improper Access Control (CWE-284) vulnerability in Apple Macos. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 22.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and CM-11 (User-installed Software).
Deeper analysis
CVE-2024-40858 is a permissions vulnerability in macOS that allows an app to access the Contacts data without user consent. The issue stems from insufficient restrictions on app permissions and affects macOS versions prior to Sequoia 15.1. It is classified under CWE-284 (Improper Access Control) with a CVSS v3.1 base score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), indicating high confidentiality and integrity impacts but no availability disruption.
A local attacker with low privileges, such as a malicious app installed by the user, can exploit this vulnerability with low complexity and no user interaction required. Successful exploitation enables unauthorized access to sensitive Contacts information, potentially allowing data exfiltration or manipulation without alerting the user.
Apple addressed this issue in macOS Sequoia 15.1 by implementing additional restrictions on permissions. Security practitioners should advise users to update to the patched version, with further details available in Apple's security advisory at https://support.apple.com/en-us/121564.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-55523
Vulnerability details
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.1. An app may be able to access Contacts without user consent.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct local permission bypass enabling unauthorized read/write access to Contacts data store on macOS, mapping to collection of sensitive information from the local system.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the specific permissions flaw by requiring patching to macOS Sequoia 15.1, preventing unauthorized Contacts access.
Enforces approved authorizations and restrictions on app access to sensitive resources like Contacts data, addressing the improper access control vulnerability.
Prohibits or restricts user-installed software, blocking the installation of malicious apps that exploit the permissions bypass.