CVE-2026-20603: 
macOS vulnerability analysis and mitigation

CVE-2026-20603 is an improper access control vulnerability (CWE-284) in the Notification Center component of Apple macOS Tahoe. An app with root privileges may be able to access private information due to insufficient redaction of sensitive data. The vulnerability affects macOS Tahoe versions prior to 26.3 and was disclosed and patched on February 11, 2026. It carries a CVSS v3.1 base score of 4.4 (Medium) (Apple Advisory).

The root cause is a failure to adequately redact sensitive information within the Notification Center component, classified as CWE-284 (Improper Access Control). An attacker must already possess an app running with root privileges on the target macOS system; from that position, the app can read private information that should be inaccessible even to root-level processes. Apple addressed the issue by improving the redaction of sensitive information in Notification Center. The vulnerability was discovered by Kirin (@Pwnrin) and LFY (@secsys) from Fudan University (Apple Advisory).

Successful exploitation results in unauthorized disclosure of private information accessible through Notification Center, impacting confidentiality with no effect on integrity or availability. Because exploitation requires an app already running with root privileges, the practical impact is limited to scenarios where an attacker has already achieved elevated access and seeks to harvest additional sensitive data from notifications. There is no known risk of lateral movement or remote code execution directly from this vulnerability (Apple Advisory).

Apple has addressed this vulnerability in macOS Tahoe 26.3, released February 11, 2026. Users and administrators should update to macOS Tahoe 26.3 or later as the primary remediation. No configuration-based workarounds have been published; upgrading is the recommended and only confirmed fix (Apple Advisory).

The vulnerability was reported by security researchers Kirin (@Pwnrin) and LFY (@secsys) from Fudan University, who have been credited in Apple's official advisory. No significant broader media coverage, vendor statements beyond the Apple advisory, or notable community discussion specific to this CVE has been identified (Apple Advisory).