Technical impact
The vulnerability allows an attacker who already has authorized access to Microsoft Graph to expose sensitive information over the network. It results in a loss of confidentiality, enabling discovery or leakage of data that should remain private.
Affected Systems
Microsoft Graph, as provided by Microsoft. No specific product versions are identified in the available data, so all revisions of the Graph API are potentially affected until a patch is released.
Risk and Exploitability
The CVSS score of 6.5 indicates a medium severity. The EPSS score of 0.00756 (< 1%) indicates a very low but nonzero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attacks would likely need authenticated access to the Graph service, and the attacker could trigger the information disclosure by sending crafted requests over the network, assuming no mitigations are in place.
