Improper access control in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network, potentially enabling the attacker to compromise the entire SharePoint environment. This vulnerability can undermine confidentiality, integrity, and availability by granting elevated rights that exceed the user’s intended access level. The primary weakness stems from an access control flaw that fails to enforce proper permission checks when a user attempts certain privileged operations.

Microsoft SharePoint Server Subscription Edition is affected by this vulnerability. Affected product version information is not explicitly provided in the advisory, so all current installations should assume potential exposure until an official update is applied.

The CVSS score of 8.8 indicates high severity, and the vulnerability is currently not listed in CISA KEV. EPSS information is unavailable, suggesting that exploitation data is not collected or deemed low priority. The likely attack vector is an internal network scenario where an authorized user leverages existing credentials to elevate privileges. Exploitation requires a valid SharePoint account and may exploit the improper access control to gain higher-level permissions, possibly leading to full control over the SharePoint server.