Improper authorization in Microsoft Office SharePoint lets an attacker who already has authorized credentials elevate their privileges across the network. The flaw permits a user with limited access to gain higher rights, enabling broader data access or configuration changes. The weakness maps to CWE-285, the classic improper authorization vulnerability.

Microsoft SharePoint Enterprise Server 2016 and Microsoft SharePoint Server 2019 are affected. No specific version ranges are provided in the CNA data, so any installation of those products is potentially vulnerable unless a later patch is applied.

The CVSS score of 8.8 indicates a high impact. The EPSS score is less than 1 %, indicating a very low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Attack typically requires an authenticated user with some level of access; based on the description, it is inferred that the attacker must already have network credentials to use the flaw to elevate privileges further. No advanced techniques are reported, so the attack path is limited to typical authenticated privilege escalation.