Flexibits Fantastical Incorrect Authorization Vulnerability in XPC Services

A vulnerability exists in the XPC services of Flexibits Fantastical, all versions prior to 4.0.16. The issue arises from inadequate client authorization checks in the 'listener:shouldAcceptNewConnection' method, which allows any local, unprivileged process to connect to the XPC service and access its methods. This flaw could be exploited by any local process without special privileges.

Impact

Exploitation of this vulnerability allows any local, unprivileged process to connect to the XPC service of Fantastical and invoke its methods, potentially leading to unauthorized access or manipulation of data within the application.

Remediation

Users can upgrade to Fantastical version 4.0.16 or later to address this vulnerability.