PT-2025-47233 · Canva · Canva For Mac

P1Tsi · Published 2025-11-18 · Updated 2025-11-18 · CVE-2025-12792

Positive Technologies (AI Summary)

CVSS v3.1

3.2

Low

Base vector

AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Canva for Mac versions prior to 1.117.1

Description The Canva for Mac desktop app, when distributed through the Mac App Store, was released without Hardened Runtime enabled. This allowed a local attacker with standard user privileges to run arbitrary code with the same permissions granted to Canva through the Transparency, Consent, and Control (TCC) framework. TCC manages user permissions for accessing protected resources on macOS.

Recommendations Update to version 1.117.1 or later.

Fix

LPE

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2025-12792

Affected Products

Canva For Mac

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-12792 · Security Note
• https://t.me/cveNotify/143126 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1990723451439497627 · Twitter Post
• https://trust.canva.com/?tcuUid=1e77a34b-f586-450b-b30d-b6e17d15b443 · Note
• https://t.me/CVEtracker/37569 · Telegram Post