TCC Bypass via misconfigured Node fuses in Nozbe
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
The configuration of Nozbe on macOS, specifically the "RunAsNode" fuse enabled, allows a local attacker with unprivileged access to execute arbitrary code that inherits Nozbe TCC (Transparency, Consent, and Control) permissions. Acquired resource access is limited to previously granted permissions by the user. Access to other resources beyond granted-permissions requires user interaction with a system prompt asking for permission. This issue was fixed in version 2025.11 of Nozbe.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA Nozbe (Nozbe) Fixed in 2025.11
Timeline
- 2026-10-02 Threatist record created from CVE-2025-53813
- 2026-10-03 Alias added: GHSA-r4cg-2rhj-cv67
References
Other 1
More Nozbe vulnerabilities
- TI-2020-03525 DoS or local data modification via malicious record IDs in WatermelonDB CVSS 3.1MEDIUM 5.9
Sources
- CVE-2025-53813 · CVE Program
- CVE-2025-53813 · NVD
- FIRST EPSS
- GHSA-r4cg-2rhj-cv67 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences