File System Access Policies Bypass in ClearanceKit on macOS
CVE-2026-33631

8.7HIGH

Key Information:

Vendor

Craigjbass

Status
Clearancekit
Vendor
CVE Published:
26 March 2026

What is CVE-2026-33631?

The ClearanceKit product on macOS has a significant access control bypass vulnerability. Versions up to and including the 4.1 branch only intercepted ES_EVENT_TYPE_AUTH_OPEN events, which led to inadequate enforcement of file access policies. As a result, certain file operation events could be exploited, allowing local processes to bypass the dedicated security policies without detection. The subsequent update in version 4.2 rectified this issue by incorporating additional event types into the access policy checks, ensuring comprehensive monitoring and enforcement across all relevant file access events.

Affected Version(s)

clearancekit < 4.2

References

https://github.com/craigjbass/clearancekit/security/advis...
x_refsource_CONFIRM
https://github.com/craigjbass/clearancekit/commit/a3d1733...
x_refsource_MISC

CVSS V3.1

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.