ClearanceKit enforces per-process file-system access policies on macOS by verifying signed policy data stored in an SQLite database. Before version 5.0.10, the ECDSA signatures cover only the canonical row content without any freshness or version binding. An attacker able to write to the database and corresponding signature rows—possible during the opfilter-update window or offline scenarios—can replay an old, legitimately signed snapshot. Because the signatures remain valid, the system accepts the stale policy data, resulting in an authentication bypass vulnerability classified as CWE-294. This allows unauthorized policy changes to be accepted by the system. The issue is fixed in version 5.0.10.

An attacker with write access to the ClearanceKit policy database and signature rows can bypass authentication by replaying previously signed policy snapshots. This undermines the integrity of the access control policies enforced by ClearanceKit, potentially allowing unauthorized file-system access or policy manipulation. The vulnerability requires local or offline access to the database during specific update windows or via decrypted backups, limiting remote exploitation. The CVSS 4.0 score is 6.9 (medium severity).

Version 5.0.10 of ClearanceKit patches this vulnerability by addressing the signature verification process to include freshness or version binding. Users should upgrade to version 5.0.10 or later to remediate this issue. Until upgraded, restrict write access to the policy database and signature tables, especially during the opfilter-update window, and protect offline backups to prevent replay attacks. Patch status is not explicitly confirmed beyond the mention of version 5.0.10 as the fixed version; users should verify with the vendor for official advisories.