Files or directories that are accessible to external parties in Microsoft Teams can be exploited by an unauthorized attacker to forge identities locally, thereby impersonating other users or organizations. The weakness arises from excessive exposure of file or directory contents, classified as CWE‑552, enabling attackers to create deceptive contexts. This compromise affects the confidentiality of user identities but does not necessarily allow code execution or service disruption.

Microsoft Teams for Android is affected. No specific version numbers are listed in the CNA data, so any installation may be vulnerable until a patch is released.

The vulnerability carries a CVSS score of 5.5, indicating moderate severity. EPSS is not available, and the flaw is not listed in CISA's KEV catalog, suggesting limited public exploitation as of now. The likely attack vector is local, requiring unauthorized access to the device running Teams, so the risk is primarily to users who may be impersonated by attackers with local privileges.