The vulnerability in Microsoft Power Automate for Desktop allows an attacker with authorized access to disclose sensitive information over a network. This leads to unintended exposure of confidential data, potentially compromising confidentiality and causing data leakage. The flaw is classified as CWE‑200, indicating an information disclosure weakness.

Microsoft Power Automate for Desktop is affected. No specific version range is listed in the data, so all installations of the product may be vulnerable until a patch is applied.

The CVSS score of 6.5 denotes moderate severity, meaning the impact is significant but not critical. Because EPSS data is not available, a precise exploitation probability cannot be quantified; however, listed in KEV it is not recognized as a known exploited vulnerability, suggesting limited public exploitation. The likely attack vector is inferred to be network‑based, where an authenticated user can trigger the disclosure of sensitive data while connected to network resources.