CVE-2026-40191

The record

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to 5.0.4-beta-1f46165, ClearanceKit's Endpoint Security event handler only checked the source path of dual-path file operations against File Access Authorization (FAA) rules and App Jail policies. The destination path was ignored entirely. This allowed any local process to bypass file-access protection by using rename, link, copyfile, exchangedata, or clone operations to place or replace files inside protected directories. This vulnerability is fixed in 5.0.4-beta-1f46165.

Affected packages

Related vulnerabilities

• CVE-2026-96398 Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. CWE-863
• CVE-2026-96384 Incorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows Forceful… CWE-863
• CVE-2026-96370 Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request… CWE-863
• CVE-2026-96373 Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. CWE-863
• CVE-2026-96366 Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. CWE-863
• CVE-2026-96356 Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. CWE-863
• CVE-2026-84917 Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful… CWE-863
• CVE-2026-84920 Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows… CWE-863