This vulnerability in Forcepoint One Endpoint (F1E) for Mac OS prior to v26.04.5758 involves an improper check for unusual or exceptional conditions (CWE-754). It enables a normal (non-admin) user to disable the SafariExtension component of the product, which is responsible for enforcing DLP protections. This bypass compromises the intended data loss prevention controls. The CVSS 4.0 base score is 4.8 (medium), reflecting local attack vector, low complexity, and limited privileges required. No vendor advisory or patch information is currently available, and the product is not a cloud service.

A non-administrative user can disable the SafariExtension of Forcepoint One Endpoint on Mac OS, effectively bypassing DLP protections. This could lead to unauthorized data exfiltration or leakage that the DLP system is designed to prevent. The impact is limited by the requirement for local access and low privileges but does reduce the effectiveness of endpoint data protection controls.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict local user permissions where possible and monitor for unusual activity related to the SafariExtension. Avoid relying solely on this DLP component for critical data protection.