The flaw allows an attacker to supply a user‑controlled key that is incorrectly authorized by Entra Device Registration. By using this key the attacker can bypass normal authorization checks and gain elevated privileges. This privilege escalation enables the attacker to perform actions that are normally restricted to higher‑level users, potentially accessing sensitive device registration data or executing administrative functions. The vulnerability represents a direct break of the intended access control model of the product, enabling unauthorized escalation within the network domain.

Microsoft Entra Device Registration is affected. No specific version information is provided by the CVE.

The CVSS score is 10, indicating that the flaw is highly severe. The EPSS score is not available, but the absence of a KEV listing does not diminish the risk, as the flaw directly permits privilege escalation. Attackers are likely able to exploit the issue over a network by crafting requests containing the user‑controlled key. The impact would be system‑wide if the victim machine is a domain controller or otherwise trusted node.