CVE-2025-8533 - Incorrect Authorization of XPC Service in Fantastical.app

Back Back to CVE browser

MEDIUM

Incorrect Authorization of XPC Service in Fantastical.app

Published Aug 7, 2025

6.9

MEDIUM

CVSS 4.0

EPSS 0.39%

Description

A vulnerability was identified in the XPC services of Fantastical. The services failed to implement proper client authorization checks in its listener:shouldAcceptNewConnection method, unconditionally accepting requests from any local process. As a result, any local, unprivileged process could connect to the XPC service and access its methods.

This issue has been resolved in version 4.0.16.

Affected products

Vendor Flexibits Product Fantastical Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <4.0.16

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Flexibits

Fantastical

unaffected

Version	Status	Constraints
0	affected	<4.0.16

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-863

Incorrect Authorization

References (3)

https://cert.pl/en/posts/2025/08/CVE-2025-8533
third-party-advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-23914
Advisory
https://flexibits.com/fantastical
product

Link	Providers	Tags
https://cert.pl/en/posts/2025/08/CVE-2025-8533		third-party-advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-23914		Advisory
https://flexibits.com/fantastical		product