Auth bypass in Sparkle Project
CVE-2025-10015
The Sparkle framework includes an XPC service Downloader.xpc, by default this service is private to the application its bundled with. A local unprivileged attacker can register this XPC service globally which will inherit TCC permissions of the application. Lack of validation of connecting client allows the attacker to copy TCC-protected files to an arbitrary location. Access to other resources beyond granted-permissions requires user interaction with a system prompt asking for permission. This issue was fixed in version 2.7.2
Vulnerability class: Broken Access Control
EPSS: 0.002 (5.2th percentile) — read the EPSS interpretation.
Affected products
- Sparkle Project — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cvd@cert.pl (third-party-advisory)
- cvd@cert.pl (product)
- cvd@cert.pl (vendor-advisory)
Frequently asked questions
- What is CVE-2025-10015?
- CVE-2025-10015 is a vulnerability in Sparkle Project, classified under Incorrect Authorization. Published 2025-09-16.
- Is CVE-2025-10015 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.