Insufficiently protected credentials in Azure Logic Apps enable an attacker who already holds legitimate access to gain elevated privileges across a network. This weakness stems from improper handling of authentication tokens, allowing users to bypass boundaries and execute actions beyond their intended scope. The vulnerability is defined as CWE‑522, highlighting that credentials are not adequately safeguarded.

Microsoft Azure Logic Apps is the sole affected product. No specific version details are provided, so all deployments should be reviewed for this weakness until a patch is available.

The CVSS base score of 8.8 indicates a high severity, and while the EPSS is not disclosed, the lack of inclusion in the KEV table suggests no publicly known exploits at this time. The attack class appears to be authenticated, requiring the attacker to possess some authorized credentials before attempting elevation. Consequently, internal actors or attackers who compromise user accounts could exploit this flaw to expand their permissions.