The vulnerability permits an attacker who has legitimate access to a user‑controlled key in Azure Cosmos DB to bypass normal authorization controls and impersonate other application or service identities. By exploiting this flaw the attacker can issue requests on behalf of another user or service, potentially masquerading as a trusted client. The primary outcome is unauthorized impersonation, exposing confidentiality and integrity of the impersonated identities beyond the scope of the attacker’s original permissions.

Microsoft Azure Cosmos DB deployments are affected. No specific version information is provided, so all instances potentially using user‑controlled keys are at risk. The vulnerability is not tied to a particular launch or patch level, meaning the risk applies across current releases until mitigated.

The CVSS score of 8.5 classifies the flaw as high severity. An EPSS score is not available, so there is no historical exploitation data to inform probability. The vulnerability is not listed in the CISA KEV catalog. Attackers with an authenticated user‑controlled key can exploit the vulnerability over the network, requiring network connectivity to Azure Cosmos DB and possession of the key. The impact is severe due to the potential for unauthorized impersonation. However, the absence of EPSS data means the likelihood of exploitation is uncertain.