Improper authorization in Microsoft Exchange Online permits an unauthorized user to read sensitive data over the network. The vulnerability stems from an access control flaw (CWE-285) that bypasses standard permission checks, resulting in disclosure of confidential information. This can compromise the confidentiality of data stored or transmitted by the affected service.

Microsoft Exchange Online users are impacted. No specific version range is enumerated in the advisory, so all deployments of Exchange Online that have not applied the Microsoft-provided fix are potentially vulnerable.

The CVSS score of 9.1 indicates a high severity impact. No EPSS score is currently available, and the issue is not listed in the CISA KEV catalog, but the lack of an exploitation probability figure does not reduce the risk, especially given the remote nature outlined in the description. The likely attack vector is via a network connection to the Exchange Online service, with no additional host or privilege prerequisites noted.