LibreOffice TCC Bypass Vulnerability in Bundled Python Interpreter on macOS

A vulnerability allowing authentication bypass has been identified in LibreOffice on macOS, specifically in versions 25.2 prior to 25.2.4. The issue arises because the application includes a Python interpreter that inherits Transparency, Consent, and Control (TCC) permissions granted to the main application bundle. This allows scripts executed by the interpreter to run with the application's TCC privileges, creating a potential security risk. In versions 25.2.4 and later, this vulnerability is addressed by implementing parent-constraints that restrict TCC permission access to the main application only.

Impact

Exploitation of this vulnerability allows scripts to be executed with the application's TCC privileges, potentially leading to unauthorized access or manipulation of user data and settings.

Remediation

Users are advised to upgrade to LibreOffice version 25.2.4 or later to address this vulnerability.