ClearanceKit, a macOS tool that intercepts file-system access events to enforce per-process access policies, had a startup defect before version 4.2.14. During startup, only the compile-time baseline rule was enforced by the opfilter component, and managed (MDM-delivered) and user-defined file-access rules were not applied until the user interacted with the GUI, triggering a policy mutation over XPC. This improper privilege management (CWE-269) allowed a temporary window where access controls were incomplete. The issue is fixed in version 4.2.14.

During the startup window before user interaction, ClearanceKit did not enforce all intended file-access policies, potentially allowing unauthorized file access that would normally be blocked by managed or user-defined rules. This could lead to privilege escalation or unauthorized data access on affected macOS systems running ClearanceKit versions prior to 4.2.14. The CVSS 4.0 score is 6.3 (medium severity), reflecting local attack vector with low complexity but significant impact on security integrity.

Upgrade ClearanceKit to version 4.2.14 or later, where this startup privilege enforcement issue has been patched. No other mitigations are indicated as the vendor has provided an official fix. Patch status is confirmed by the vendor advisory.