Improper input validation in Microsoft Office SharePoint allows an authorized attacker to read information over a network. The vulnerability is a classic CWE‑20 type flaw where unexpected or malformed input leads to unintended disclosure of data. An attacker who has legitimate credentials or sufficient access rights on the SharePoint Server can trigger the flaw to obtain sensitive content that should otherwise be protected by the platform’s access controls.

Microsoft SharePoint Server Subscription Edition is affected. No specific version numbers are listed, so all installations of the Subscription Edition that have not applied mitigations remain vulnerable.

The CVSS score of 6.5 indicates a moderate severity. Since no EPSS score is available and the vulnerability is not listed in CISA KEV, there is no current evidence of widespread exploitation. The likely attack vector requires an authorized attacker; therefore the risk is limited to users with valid credentials or compromised accounts. In the absence of widespread exploitation data, monitoring and timely patching are prudent steps.