CVE-2025-12792 | THREATINT

Description

The Mac App Store distribution of the Canva for Mac desktop app before 1.117.1 was built without Hardened Runtime. A local threat actor with unprivileged access could execute arbitrary code that inherits the TCC (Transparency, Consent, and Control) permissions assigned to Canva.

PUBLISHED Reserved 2025-11-06 | Published 2025-11-18 | Updated 2025-11-18 | Assigner Bugcrowd

LOW: 3.2CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N

Problem types

CWE-276 Incorrect Default Permissions

Product status

Default status

unaffected

Any version before 1.117.1

affected

Credits

p1tsi (Bugcrowd) finder

References

trust.canva.com/?tcuUid=1e77a34b-f586-450b-b30d-b6e17d15b443

cve.org (CVE-2025-12792)

nvd.nist.gov (CVE-2025-12792)

Download JSON