Improper handling of insufficient permissions in Microsoft Dynamics 365 (on-premises) lets an attacker who already has some authorization raise their privileges across the network. The vulnerability can allow the attacker to gain elevated access and potentially control system functions that should be restricted, leading to increased confidentiality and integrity risks.

Microsoft Dynamics 365 (on-premises) version 9.1 is affected.

The CVSS score of 8.8 indicates a high severity. While an EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the risk remains significant because the attack vector requires an authorized user with existing access, which is a realistic scenario in many environments. Exploitation would involve the attacker leveraging the application's insufficient permission checks to elevate privileges over the network, resulting in potential system compromise.