The vulnerability arises from missing authorization checks within Microsoft SharePoint, specifically violating CWE-862 (Missing Authorization). The flaw allows an authenticated user with appropriate access to perform actions beyond their assigned permissions, such as modifying configuration, accessing protected content, or executing administrative functions. By exploiting this oversight, an attacker can elevate privileges across the SharePoint environment, potentially gaining unrestricted control over all site collections, data, and administrative controls held by the system.

This vulnerability affects Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, and Microsoft SharePoint Server Subscription Edition. All versions listed.

The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1 % suggests that the exploitation probability remains low. The vulnerability is not in the CISA KEV catalog. Based on the description, it is inferred that the attacker must already have some level of authenticated access to SharePoint; the flaw does not provide a remote entry point for an unauthenticated user. An internal attacker could exploit the missing checks to increase privileges across the network, potentially impacting all SharePoint resources.