An improper access control flaw in Microsoft Partner Center lets an attacker who already has authorized access their privileges within the platform. The weakness, identified as CWE-284, allows the attacker to perform higher‑level functions such as managing partner relationships or accessing sensitive configuration settings, thereby compromising confidentiality and integrity of Partner Center data.

The vulnerability applies to the Microsoft Partner Center service. Specific version information was not disclosed, so all deployments that are currently connected to the platform and have at least one authorized role are potentially affected.

The CVSS score of 9.6 classifies it as critical severity, indicating that a successful attack could lead to full control over the service. The EPSS score of less than 1% suggests that exploitation is currently rare, and it is not listed in the CISA KEV catalog. The most likely attack vector is through an authenticated session within the partner community, as the description indicates an attacker already possesses valid credentials. No additional prerequisites beyond authorized access are mentioned, but the flaw requires the attacker to be able to authenticate to the Partner Center environment.