The flaw is an incorrect authorization check that permits a user with legitimate access to read data that should be restricted. Because the flaw is an authorization bypass through function parameters, as denoted by CWE-863, an attacker can gain access to sensitive information, potentially exposing confidential data and enabling later attacks.

The vulnerability affects Microsoft SharePoint Server Subscription Edition. No specific versions are listed in the advisory, so all deployed instances of this product are potentially impacted.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation at present. The likely attack vector is over the network, where an authorized attacker already able to authenticate into SharePoint can exploit the authorization flaw to read disallowed data. The risk is increased in environments with widely exposed SharePoint endpoints or where sensitive data is stored.