Improper neutralization of escape, meta, or control sequences in Microsoft Power Apps allows an authorized attacker to perform spoofing over a network. This flaw, classified as CWE‑150, can let an attacker impersonate legitimate users or misrepresent actions, undermining trust.

Microsoft Power Apps is the affected product. No specific application version is listed, so all deployments of Microsoft Power Apps could be at risk.

The vulnerability carries a CVSS score of 9, indicating high severity, and an EPSS score of < 1%, reflecting a very low but non‑zero likelihood that it will be exploited in the wild. It is not listed in the CISA KEV catalog. The attack vector is inferred to be over a network, requiring the attacker to be an authenticated user who can submit crafted input to neutralize security controls.