CVE-2026-20666: 
macOS vulnerability analysis and mitigation

CVE-2026-20666 is an improper authorization vulnerability in Apple macOS Tahoe affecting the NSOpenPanel component. An app may be able to access sensitive user data due to an authorization issue that was addressed with improved state management. The vulnerability was disclosed on February 11, 2026, as part of Apple's macOS Tahoe 26.3 security update. It affects macOS Tahoe versions prior to 26.3 and carries a CVSS v3.1 base score of 5.5 (Medium) (Apple Advisory).

The vulnerability is classified as CWE-285 (Improper Authorization) and resides in the NSOpenPanel component of macOS Tahoe. The root cause is an authorization issue stemming from improper state management, which allowed an app to bypass access controls and read sensitive user data it should not have been permitted to access. Exploitation requires local access with low privileges and no user interaction, making it exploitable by any installed app running under a standard user account. Apple credited an anonymous researcher with the discovery (Apple Advisory).

Successful exploitation allows a malicious application to access sensitive user data that should be protected by macOS authorization controls, resulting in a high confidentiality impact. There is no impact to integrity or availability. The scope is limited to the local system, but the data exposed could include files or information accessible through the NSOpenPanel file-picker interface, potentially including documents, credentials, or other user-sensitive content (Apple Advisory).

Apple addressed this vulnerability in macOS Tahoe 26.3, released February 11, 2026. Users should update to macOS Tahoe 26.3 or later via System Settings > General > Software Update. No configuration-based workarounds have been published; upgrading to the patched release is the only recommended remediation (Apple Advisory).

The vulnerability received standard coverage as part of Apple's February 2026 security update cycle, with aggregator sites and security feeds noting its disclosure alongside dozens of other CVEs in the same advisory. No notable researcher commentary, vendor statements beyond the official advisory, or significant social media discussion specific to CVE-2026-20666 has been identified (Apple Advisory).