PT-2025-34758 · Apple+1 · Apple Macos+1

Karol Mazurek · Published 2025-08-26 · Updated 2025-08-26 · CVE-2025-8700

Positive Technologies (AI Summary)

CVSS v4.0

4.8

Medium

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions: Invoice Ninja versions prior to 5.0.175

Description: Invoice Ninja on macOS is susceptible to a local privilege escalation issue. The presence of the “com.apple.security.get-task-allow” entitlement allows local attackers with unprivileged access to attach a debugger, read or modify process memory, and inject code into the application's context, even with Hardened Runtime and Transparency, Consent, and Control (TCC) enabled. Access is limited to previously granted user permissions, but the entitlement bypasses a system authorization dialog normally required for debugging tools.

Recommendations: Update to version 5.0.175 or later.

Fix

Weakness Enumeration

CWE-497

Related Identifiers

CVE-2025-8700

Affected Products

Invoice Ninja

Apple Macos

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-8700 · Security Note
• https://t.me/cveNotify/133446 · Telegram Post
• https://t.me/CVEtracker/30920 · Telegram Post
• https://invoiceninja.com · Note
• https://cert.pl/en/posts/2025/08/tcc-bypass · Note
• https://twitter.com/CVEnew/status/1960329126868304225 · Twitter Post