Improper access control in Azure Synapse allows an authorized attacker to elevate privileges across a network. The flaw is a typical example of CWE‑284, where access rights are not properly verified, enabling a user with limited access to acquire higher authority. Such an escalation can permit the user to read, modify, or delete data and configuration settings beyond the scope granted to their original role.

All deployments of Microsoft Azure Synapse are affected, as no specific version information is disclosed. The vulnerability applies to any instance where users are granted access to the service, regardless of the deployment size or configuration.

The CVSS score of 4.8 indicates a medium severity. The EPSS score of <1% suggests the likelihood of exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, an attacker must first be authenticated or authorized to Azure Synapse, after which the flaw can be used to raise privileges across the network. No additional prerequisites are stated in the advisory.