The vulnerability allows an attacker to configure the Host header to reference a different tenant and then reuse the self‑service signup flow, even when that tenant has disabled the signup UI. This results in unintended account creation and access within the target tenant without proper authorization because the underlying API endpoint continues to accept cross‑tenant requests based solely on the Host header. The weakness is an improper access control flaw as identified by CWE‑284. The supplier evaluated this report and determined that it does not cross a security boundary, indicating that the observed behavior is a configuration/state issue rather than an exploitable product vulnerability affecting tenant isolation. This can lead to unauthorized user registration, privilege escalation within the target tenant, and a breach of tenant isolation without any additional exploits such as injection or buffer overflow.

Microsoft Azure API Management is impacted when the self‑service signup option is enabled. The flaw exists in all releases up to and including 2025‑10‑17 that expose the signup API endpoint; there are no specific patch versions listed in the data, but the flaw applies to any configuration that does not fully disable the endpoint at the API level.

The flaw carries a CVSS of 9.8, indicating a critical severity. The EPSS score of <1% suggests that, in practice, exploitation attempts are currently rare, however the potential impact remains substantial. The vulnerability is not listed in the CISA KEV catalog. An attacker who controls the Host header or can forge cross‑tenant requests would be able to register a new account on a protected tenant, violating confidentiality and integrity of tenant isolation. The attack is likely straightforward and does not require complex prerequisites beyond accessing the signup API; the primary attack vector is the web API traffic where the Host header is manipulated.