⚠ Actively exploited
Added to CISA KEV on 2021-11-03. Federal agencies required to patch by 2021-11-17. Required action: Apply updates per vendor instructions..

CVE-2021-30713 — Missing Authorization in Apple Macos

CWE-862 — Missing AuthorizationCWE-20 — Improper Input ValidationCWE-863 — Incorrect Authorization8 documents7 sources
Severity
7.8HIGHNVD
EPSS
0.2%
top 63.13%
CISA KEV
KEV
Added 2021-11-03
Due 2021-11-17
Exploit
Exploited in wild
Active exploitation observed
Affected products
2
Apple MacosApple MAC OS X
Timeline
PublishedSep 8
KEV addedNov 3
KEV dueNov 17
Latest updateJul 28
CISA Required Action: Apply updates per vendor instructions.

Description

A permissions issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.4. A malicious application may be able to bypass Privacy preferences. Apple is aware of a report that this issue may have been actively exploited..

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages3 packages

▶CVEListV5apple/macosunspecified — 11.4
▶NVDapple/macos< 11.4
▶NVDapple/mac_os_x10.15 — 10.15.7+1

🔴Vulnerability Details

3
GHSA
GHSA-x3vf-fcq8-6cpg: A permissions issue was addressed with improved validation↗2022-05-24
▶
CVEList
CVE-2021-30713: A permissions issue was addressed with improved validation↗2021-09-08
▶
VulnCheck
Apple macOS Unspecified Vulnerability↗2021
▶

📋Vendor Advisories

3
CISA
Apple macOS Unspecified Vulnerability↗2021-11-03
▶
Apple
CVE-2021-30713: Security Update 2021-005 Catalina↗2021-09-13
▶
Apple
CVE-2021-30713: macOS Big Sur 11.4↗2021-05-24
▶

🕵️Threat Intelligence

1
Bleepingcomputer
Microsoft: macOS Sploitlight flaw leaks Apple Intelligence data↗2025-07-28
▶
CVE-2021-30713 — Missing Authorization in Apple Macos | cvebase