A missing authentication check in a critical Microsoft 365 Copilot function allows an attacker who can reach the service over a network to read sensitive data that should be protected. The vulnerability is classified as a severe vulnerability with a CVSS score of 9.8, indicating that exploitation could fully compromise data confidentiality for affected accounts.

The product impacted is Microsoft 365 Copilot. No specific version numbers are supplied in the CNA data, so the vulnerability is presumed to apply to all currently deployed instances of the Copilot service until a patch is applied.

The absence of an authentication requirement means that any network‑connected user, without privileged credentials, can trigger the vulnerable operation. The high CVSS score alone signals a high category of risk, and the lack of information on exploitation probability (EPSS not available) and absent KEV listing do not reduce the urgency, given the clear disclosure potential. Attackers could exploit this remotely over the network, leveraging standard HTTP/HTTPS traffic to the Copilot endpoint.