The Mac App Store version of the Canva for Mac desktop app prior to 1.117.1 lacked the Hardened Runtime security feature. This flaw allows a local unprivileged user to execute arbitrary code that inherits Canva's TCC permissions, potentially bypassing user consent controls. The vulnerability has a low CVSS score of 3.2 and does not impact confidentiality or availability beyond limited code execution with inherited permissions.