Auth bypass in Sparkle Project
CVE-2025-10015
The Sparkle framework includes an XPC service Downloader.xpc, by default this service is private to the application its bundled with. A local unprivileged attacker can register this XPC service globally which will inherit TCC permissions of the application. Lack of validation of connecting client allows the attacker to copy TCC-protected files to an arbitrary location. Access to other resources beyond granted-permissions requires user interaction with a system prompt asking for permission. This issue was fixed in version 2.7.2
Vulnerability class: Broken Access Control
Published · last modified .
EPSS exploit prediction
EPSS: 0.002 (5.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 5th percentile — 5.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
- Sparkle Project — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cert.pl/en/posts/2025/09/CVE-2025-10015 (third-party-advisory)
- github.com/sparkle-project/Sparkle (product)
- github.com/sparkle-project/Sparkle/discussions/2764 (vendor-advisory)
Frequently asked questions
- What is CVE-2025-10015?
- CVE-2025-10015 is a vulnerability in Sparkle Project, classified under Incorrect Authorization. Published 2025-09-16.
- Is CVE-2025-10015 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.