ClearanceKit versions before 5.0.4-beta-1f46165 on macOS enforce per-process file access policies by intercepting file-system access events. However, the Endpoint Security event handler only validated the source path against File Access Authorization rules and App Jail policies during dual-path file operations, neglecting to check the destination path. This flaw permitted local processes with limited privileges to circumvent file access restrictions by using file operations such as rename, link, copyfile, exchangedata, or clone to place or overwrite files within protected directories. The vulnerability is addressed in version 5.0.4-beta-1f46165.

Exploitation of this vulnerability allows a local process with limited privileges to bypass file access protections and place or replace files inside directories that should be protected by ClearanceKit policies. This could lead to unauthorized modification or replacement of files within protected directories, potentially undermining system integrity or security controls. There are no known exploits in the wild at this time.

A fix for this vulnerability is available in clearancekit version 5.0.4-beta-1f46165. Users should upgrade to this version or later to remediate the issue. Since the vendor advisory does not specify any temporary workarounds or alternative mitigations, applying the official update is the recommended action.