CVE-2021-30713: Apple macOS privacy preference bypass via missing authorization

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is in CISA KEV with reported active exploitation and high CVSS impact, though it requires local access and low privileges rather than being remotely exploitable.

What it is

macOS Big Sur before 11.4 has a permissions validation flaw (CWE-862 missing authorization) that lets a malicious application bypass Privacy preferences. Apple states it is aware of a report that this issue may have been actively exploited, so it matters as a local privilege and privacy control bypass on affected Macs.

Impact

A local attacker running a malicious app can bypass macOS Privacy (TCC) preferences, gaining access to protected user data and resources that should require explicit consent. The CVSS vector indicates high confidentiality, integrity and availability impact within the local context.

Attack surface

Reached locally: the CVSS vector is AV:L with PR:L and UI:N, so the attacker needs local access and low privileges but no user interaction. No network vector or authentication bypass over the network is described.

Exploitation

Listed in CISA KEV with a 2021-11-03 addition and 2021-11-17 remediation due date, and Apple states it may have been actively exploited; EPSS 30-day probability is about 7 percent (93.9th percentile). No ransomware campaign use is documented.

What to do

• Update macOS to Big Sur 11.4 or later per Apple advisories HT212529 and HT212805.
• Restrict local execution of untrusted applications and enforce application allowlisting on managed Macs.
• Review and tighten Privacy/TCC permissions and monitor for unexpected changes to protected resource access.
• Apply the CISA KEV required action and track remediation against the 2021-11-17 due date.
• Audit local admin and standard user accounts to limit who can run arbitrary code on endpoints.

Detection

• Monitor for unexpected or unauthorized modifications to TCC/Privacy preference databases on macOS endpoints.
• Alert on processes accessing protected resources (camera, microphone, screen recording, files) without a corresponding user consent record.
• Hunt for execution of untrusted or unsigned applications from user-writable directories on macOS hosts.
• Correlate endpoint telemetry with Apple security update status to find unpatched Big Sur systems below 11.4.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.