The vulnerability is a missing authorization check in Microsoft Office SharePoint that allows an attacker who already has authorized access to increase their privileges. This elevation of privilege could let the attacker perform actions they normally would not be permitted to, such as modifying content, creating or deleting lists, exporting confidential data, or executing arbitrary code in the context of higher‑privileged users. The weakness is identified as CWE‑862 (Missing Authorization Check).

Microsoft SharePoint Server Subscription Edition is affected. No specific version ranges are listed in the available data.

The CVSS score of 8.8 classifies this flaw as high severity and indicates that the potential impact is substantial. The EPSS score is not available, so the current exploitation probability cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. Attackers with legitimate network access to the SharePoint instance can exploit the missing authorisation; the flaw can be leveraged remotely over the network. The ability to elevate privileges creates a broad threat surface that could be used to compromise data integrity, confidentiality and potentially availability through further post‑exploitation steps.