Ventura 13.5 update - accepts non-admin credentials

marcint0sh wrote:

I've in the process of updating to macOS Ventura 13.5

I am logged into my "Standard" user account. Before starting the update I got a dialog asking to enter my password - my Standard account password was accepted....alarming

I've reported this via the Feedback Assistant

Anyone else experienced this?

Is there an associated issue..?

You can remove the standard user account and compare your results.

ref: Delete a user or group on Mac - Apple Support

Verify your Settings.

>System Settings>Users & Groups make some change to your user accounts

I actually tried to do what you did on an older Mac laptop we have. It's a lower MacOS than 13.4 or 13.5, however. It did not accept the non-administrator credentials, but did proceed after the administrator credentials were entered.

So I cannot reproduce your issue with an earlier MacOS. But it looks from your screenshots that what you describe did indeed happen to you. I think you should report this as a bug to Apple.

Feedback - macOS - Apple

Product Feedback - Apple

The reason you should report it is that it appears to relate to a possibly unaddressed security vulnerability, which I think will be of interest to Apple.

I see it now. Don't believe it should do that. Give this a try: boot into Safe Mode in your Standard account according to How to use safe mode on your Mac and test to see if the problem persists. Reboot normally and test again.

NOTE 1: Safe Mode boot can take up to 3 - 5 minutes as it's doing the following; 

• Verifies your startup disk and attempts to repair directory issues, if needed

• Loads only required kernel extensions (prevents 3rd party kernel/extensions from loading)

• Prevents Startup Items and Login Items from opening automatically

• Disables user-installed fonts 

• Deletes font caches, kernel cache, and other system cache files

NOTE 2: if you have a wireless keyboard with rechargeable batteries connect it with its charging cable before booting into Safe Mode. This makes it act as a wired keyboard as will insure a successful boot into Safe Mode.

If that does'n't clear things up you may have to create a new standard user account and text it. If it works as it should then delete the original standard account.

Any account, whether standard or administrative, will require a user name and password to open when booting up and logging in.

Guest accounts don't have passwords but they are restricted in what they can do while logged in.

my Standard account password was accepted....alarming

I don't use a standard account so I have no idea if it is normal, but I can't understand why you think it is alarming.

Did you enter an admin-capable username and then it accepted the other user's password?

The only time I saw something similar to this was on my son's 2020 MBA. His Admin user PW and the Standard user PW were the same. No idea why he set it up like that, but he did.

Consequently, he sometimes thought he'd logged in as standard but had in fact logged in as Admin.

I guess I would like my standard users to be able to update. If I had a bunch of fragile software installed that breaks at every update, that would be a problem.

I have no idea if it is abnormal or not. I just don't think it is "alarming."

FWIW, I don't believe that should work in a Standard user account. The problem is it's hard to test unless someone hasn't updated yet and tries a Standard account. I would contact Apple Support