A missing authorization check in Visual Studio Code allows an attacker who can run the application locally to bypass a built‑in security feature. The flaw permits the attacker to use that feature without proper authorization, potentially leading to unauthorized access to data or privileged actions within the code editor environment.

The product affected is Microsoft Visual Studio Code. No specific version range is listed in the CNA data, so all installations of Visual Studio Code may be at risk until a patch is applied.

The CVSS score of 7.8 indicates a high severity weakness. EPSS data is not available, so the estimated likelihood of exploitation is unclear, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local, inferred from the description that the attack requires local execution of Visual Studio Code. An attacker with local access could exploit the flaw to perform actions that are normally restricted by the missing authorization check.