An attacker who already holds an authorized sharepoint account can elevate their privileges to higher levels, potentially gaining full control over the SharePoint Server. The flaw is an error in authorization enforcement, which the CVE lists under CWE-863. The impact is limited to privilege escalation because the attacker must be authenticated first, but once elevated they could modify or delete content, configure settings, or possibly access sensitive data. The vulnerability does not grant arbitrary code execution or denial of service on its own.

Microsoft SharePoint Server Subscription Edition is affected. No specific version numbers are listed, so any installation of this product that is not updated with a later patch may be vulnerable.

The CVSS score of 4.3 indicates a moderate severity, but the exploit is an authenticated one, so the attacker must already be able to log in. The EPSS score is not available, which means we lack data on the current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a local or network-based authenticated session; the description does not mention remote unauthenticated exploitation, so that is inferred.