An attacker can control an external resource reference that triggers a spoofing action within Microsoft Partner Center. This flaw permits unauthorized users to masquerade as legitimate entities in the platform, potentially leading to fraudulent transactions, data manipulation, and impersonation of partner accounts. The weakness maps to CWE-610, indicating improper restriction of external entity references. The vulnerability could compromise confidentiality, integrity, and availability of Partner Center operations.

Microsoft Partner Center is affected, all current releases are vulnerable. No specific version list is provided, so administrators should verify all instances of Partner Center for potential impact.

The CVSS base score is 8.2, indicating high severity if exploited. The EPSS score is not available, but the lack of KEV listing suggests it has not yet been publicly exploited. The likely attack vector is remote over the network, exploiting the externally controllable resource reference. The impact would enable the attacker to gain privileges and impersonate legitimate partners, posing a significant risk to the integrity and trust of the platform.