Improper access control in Azure Logic Apps permits an attacker who already possesses authorized credentials to elevate privileges across the network, potentially granting unintended access to resources and services. This flaw represents a classic authorization bypass, where the system fails to enforce the principle of least privilege for users with legitimate access. The attack does not necessarily involve exploit code but can substantially increase the attacker's authority once exploited.

Microsoft Azure Logic Apps is the affected product. No specific version range is published, implying the vulnerability may exist across all current releases until a patch is applied.

The CVSS score of 9.9 highlights the high severity of this issue, while the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploits yet, but the need for authorized access means insiders or compromised credentials pose the threat. The likely attack path requires an attacker to log into Azure using valid credentials; from there the flaw can be triggered, resulting in elevation of privileges.