The vulnerability is an improper neutralization of input during web page generation, known as a cross‑site scripting flaw (CWE‑79). An attacker who already has authorized SharePoint access can inject malicious content that is rendered in the browser, allowing them to spoof page content or user interface elements. This can mislead users into believing they are interacting with legitimate SharePoint features, potentially facilitating social‑engineering or data‑exfiltration attempts.

Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, and Microsoft SharePoint Server Subscription Edition. The issue applies to all pending releases of these products as listed, with no specific version range disclosed.

The CVSS score of 4.6 indicates a low to moderate impact, with no confirmed remote exploitation or code execution. EPSS is not available, and the vulnerability is not in the CISA KEV catalog. Likely exploitation requires an attacker to have legitimate edit permissions within SharePoint, then supply crafted input that the server fails to sanitize, resulting in client‑side script execution that displays spoofed content.