Improper access control in Microsoft M365 Copilot for Desktop allows an unauthorized attacker to perform spoofing locally, potentially enabling the attacker to impersonate other users or actions within the application. This flaw directly undermines the integrity of user identity, which can lead to credential misuse or confusion over user actions.

The vulnerability affects Microsoft M365 Copilot for Desktop. Specific version information is not provided, so all current releases of the product are presumed susceptible until a patch is applied.

The CVSS score of 6.2 indicates a moderate severity, and the EPSS score is not available, suggesting no publicly known exploitation data yet. This vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local; an attacker must gain unauthorized local access to execute spoofing actions. No exploitation prerequisites beyond compromising local privileges are explicitly stated in the description.