CVE-2025-8533

A vulnerability was identified in the XPC services of Fantastical. The services failed to implement proper client authorization checks in its listener:shouldAcceptNewConnection method, unconditionally accepting requests from any local process. As a result, any local, unprivileged process could connect to the XPC service and access its methods. This issue has been resolved in version 4.0.16.

CVSS

No CVSS.

References

Link	Resource
https://cert.pl/en/posts/2025/08/CVE-2025-8533
https://flexibits.com/fantastical

Configurations

No configuration.

History

15 Apr 2026, 00:35

Type	Values Removed	Values Added
Summary		(es) Se identificó una vulnerabilidad en los servicios XPC de Fantastical. Estos servicios no implementaban las comprobaciones de autorización de cliente adecuadas en su método listener:shouldAcceptNewConnection, aceptando incondicionalmente las solicitudes de cualquier proceso local. Como resultado, cualquier proceso local sin privilegios podía conectarse al servicio XPC y acceder a sus métodos. Este problema se ha resuelto en la versión 4.0.16.

07 Aug 2025, 10:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-08-07 10:15

Updated : 2026-04-15 00:35

NVD link : CVE-2025-8533

Mitre link : CVE-2025-8533

CVE.ORG link : CVE-2025-8533

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2025-8533", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-08-07T10:15:38.410", "references": [{"url": "https://cert.pl/en/posts/2025/08/CVE-2025-8533", "source": "cvd@cert.pl"}, {"url": "https://flexibits.com/fantastical", "source": "cvd@cert.pl"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in the XPC services of Fantastical. The services failed to implement proper client authorization checks in its listener:shouldAcceptNewConnection method, unconditionally accepting requests from any local process. As a result, any local, unprivileged process could connect to the XPC service and access its methods.\n\n\n\n\nThis issue has been resolved in version 4.0.16."}, {"lang": "es", "value": "Se identific\u00f3 una vulnerabilidad en los servicios XPC de Fantastical. Estos servicios no implementaban las comprobaciones de autorizaci\u00f3n de cliente adecuadas en su m\u00e9todo listener:shouldAcceptNewConnection, aceptando incondicionalmente las solicitudes de cualquier proceso local. Como resultado, cualquier proceso local sin privilegios pod\u00eda conectarse al servicio XPC y acceder a sus m\u00e9todos. Este problema se ha resuelto en la versi\u00f3n 4.0.16."}], "lastModified": "2026-04-15T00:35:42.020", "sourceIdentifier": "cvd@cert.pl"}