Improper input validation in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. This flaw can enable an attacker to display content that appears to originate from a trusted source, potentially leading to deception or misinformation. The vulnerability is classified as a moderate severity flaw with a CVSS score of 4.6, indicating that the impact, while significant for targeted users, does not compromise the entire system or allow broader system control.

Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, and Microsoft SharePoint Server Subscription Edition are affected. No specific sub‑release or patch level is cited beyond the general product names.

The CVSS score of 4.6 indicates a moderate impact. The EPSS score of < 1% suggests a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an authenticated user with permission to submit content, as inferred from the updated description. Once exploiting the flaw, the attacker can cause SharePoint to display content that falsely appears to come from a trusted source. No publicly exposed unauthenticated path is required to exploit the vulnerability.