anonhaven

CVE-2026-78236

HIGH CVSS 3.1: 8.8 EPSS 0.09%
Updated Aug 26, 2026
Admin By Request (Abr)
Parameter Value
CVSS 8.8 (HIGH)
Type CWE-327 (Weak Crypto Algorithm), CWE-284 (Improper Access Control), CWE-285 (Improper Authorization), CWE-287 (Improper Authentication)
Vendor Admin By Request (Abr)
Public PoC No

An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by communicating over Cross-Process Communication (XPC) while masquerading as an Apple-signed process.

Attack Parameters

Attack Vector
Local
Requires local access
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed

Impact Assessment

Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service

CVSS Vector v3.1

Weakness Type (CWE)

CWE-327 Weak Crypto Algorithm
CWE-284 Improper Access Control
CWE-285 Improper Authorization
CWE-287 Improper Authentication

Vulnerable Products

admin by request (abr):admin by request (abr)

References 2

https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-110/
NVD
https://docs.adminbyrequest.com/security-advisories/abr-mac-26-01.htm
NVD
Share Post Share Share Share

Related Vulnerabilities

CVE-2026-78237

Admin By Request (Abr)

7.8