A server‐side request forgery flaw exists in the Azure Custom Locations Resource Provider that can be abused by an authorized user. By causing the provider to access arbitrary URLs, an attacker can obtain unauthorized access or modify resources, effectively elevating their permissions within the Azure environment. The weakness is classified as CWE‑918 and results in unauthorized privilege escalation.

The vulnerability affects the Microsoft Azure Custom Locations Resource Provider. No affected‐version data is available in the CVE payload, so administrators should assume that any deployment of the provider may be vulnerable until Microsoft releases a patch. Future updates from Microsoft will specify the fixed versions.

The CVSS score of 9.6 signals critical severity, yet the EPSS score of less than 1 % indicates that real‑world exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a user with legitimate access to the provider’s operations and the ability to influence its outbound network requests. Successful exploitation could allow the attacker to gain broader privileges within the associated Azure subscription or compromise other resources reachable from the network.