An incorrect authorization check in Microsoft Office SharePoint enables an attacker who already holds some level of access to raise their privileges across the network. The flaw follows CWE-863, elevating a user’s rights to potentially administrative levels and compromising confidentiality, integrity, and availability of the SharePoint environment.

Microsoft SharePoint Server Subscription Edition is affected. No specific software versions are listed by Microsoft; all installations remain susceptible until patched.

The CVSS score of 8.8 classifies this issue as high severity, indicating a serious risk if not remediated. EPSS score is less than 1%, indicating a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, meaning no confirmed widespread exploits are documented. Attackers would require prior authorized access to the SharePoint network environment and could exploit the flaw remotely over the network once the insider or compromised credential is in place.