craigjbass ClearanceKit up to 5.0.9 SQLite policy store store.db Local Privilege Escalation

Summaryinfo

A vulnerability was found in craigjbass ClearanceKit up to 5.0.9. It has been classified as very critical. Affected by this issue is some unknown functionality of the file /Library/Application Support/clearancekit/store.db of the component SQLite policy store. The manipulation leads to Local Privilege Escalation. This vulnerability is uniquely identified as CVE-2026-47133. Local access is required to approach this attack. No exploit exists.

Detailsinfo

A vulnerability was found in craigjbass ClearanceKit up to 5.0.9 and classified as very critical. This issue affects an unknown code block of the file /Library/Application Support/clearancekit/store.db of the component SQLite policy store. The manipulation with an unknown input leads to a local privilege escalation vulnerability. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to version 5.0.10, each table in the on-disk SQLite policy store (`/Library/Application Support/clearancekit/store.db`) is verified using an ECDSA signature stored in the `data_signatures` table. The signed payload contains only the canonical row content, with no version counter or freshness binding. An attacker who can write `store.db` and the matching `data_signatures` row — feasible during the opfilter-update window when the Endpoint Security filter is offline, or via offline-boot / decrypted-backup scenarios — can substitute a previously-captured legitimately-signed snapshot. opfilter accepts the older snapshot as fully valid on next boot because the existing signatures still verify. Version 5.0.10 patches the issue.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-47133 since 05/18/2026. The exploitation is known to be easy. An attack has to be approached locally. Additional levels of successful authentication are required for exploitation. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/20/2026).

Upgrading to version 5.0.10 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• craigjbass

Name

• ClearanceKit

Version

• 5.0.0
• 5.0.1
• 5.0.2
• 5.0.3
• 5.0.4
• 5.0.5
• 5.0.6
• 5.0.7
• 5.0.8
• 5.0.9

Website

• Product: https://github.com/craigjbass/clearancekit/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion