Azure SQL Database contains an improper access control flaw that permits an attacker who already has some level of access over a network to gain higher privileges. The vulnerability can enable an attacker to perform unauthorized actions such as creating or modifying database objects, reading sensitive data, or executing arbitrary SQL commands, thereby compromising confidentiality, integrity, and availability of the protected data. The weakness is classified as CWE‑284, reflecting a failure of access control. The CVSS score of 9.1 indicates a high severity and the potential for significant damage if exploited.

The affected product is Microsoft Azure SQL Database. No specific service pack or version is listed, so all deployments of the base Azure SQL Database service are potentially impacted until the patch is applied.

The flaw has a severe CVSS score and is currently not documented in the CISA KEV catalog; its EPSS metric is not available. Attackers would need network connectivity to the database instance and an existing authenticated or partially authenticated session. Because the vulnerability can be leveraged after obtaining any level of network access, the risk of exploitation is considered high in environments that expose Azure SQL Database endpoints to broader networks. No additional exploitation prerequisites are disclosed in the provided data.