The vulnerability allows an attacker who already has authorized access to Microsoft Graph to expose sensitive information over the network. It results in a loss of confidentiality, enabling discovery or leakage of data that should remain private.

Microsoft Graph, as provided by Microsoft. No specific product versions are identified in the available data, so all revisions of the Graph API are potentially affected until a patch is released.

The CVSS score of 6.5 indicates a medium severity. No EPSS score is available, so the probability of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Attacks would likely need authenticated access to the Graph service, and the attacker could trigger the information disclosure by sending crafted requests over the network, assuming no mitigations are in place.