ClearanceKit is a macOS security tool that intercepts file-system access events to enforce per-process access policies. Prior to version 4.2.4, it failed to intercept two specific event types related to file operations (ES_EVENT_TYPE_AUTH_EXCHANGEDATA and ES_EVENT_TYPE_AUTH_CLONE), resulting in missing authorization checks (CWE-862). This allowed local processes to bypass the intended file access restrictions. The vulnerability is fixed in version 4.2.4 by subscribing to these event types and processing them through the existing policy evaluation mechanism. The CVSS 4.0 base score is 8.4, indicating high severity, with local attack vector, low attack complexity, no user interaction, and high impact on confidentiality and integrity.

Local attackers with low privileges can bypass ClearanceKit's file access policies, potentially gaining unauthorized access to protected files or data on the affected macOS system. This undermines the security controls intended to restrict file operations per process, leading to confidentiality and integrity risks. There are no known exploits in the wild at the time of publication.

Users should upgrade ClearanceKit to version 4.2.4 or later, which includes the fix for this vulnerability. After upgrading, it is necessary to reactivate the ClearanceKit system extension to ensure the new event types are properly intercepted and enforced. No other mitigation actions are indicated by the vendor advisory.