Nozbe TCC Permission Bypass Vulnerability on macOS

A vulnerability in Nozbe for macOS, related to the 'RunAsNode' fuse being enabled, allows local attackers with unprivileged access to execute arbitrary code that inherits Nozbe's Transparency, Consent, and Control (TCC) permissions. This exploitation could enable access to user files in privacy-protected folders without triggering prompts for permission. The vulnerability affects all versions prior to 2025.11.

Impact

Exploitation of this vulnerability allows for arbitrary code execution with the same TCC permissions that Nozbe has been granted by the user, potentially leading to unauthorized access to sensitive files.

Remediation

Users can update to Nozbe version 2025.11 to address this vulnerability.