The vulnerability is a manifestation of CWE-639, Authorization Bypass Through User-Controlled Key, in Microsoft Azure Container Registry. An authorization bypass allows an attacker who controls a key to elevate privileges over a network, enabling unauthorized users to assume higher privilege levels than intended. Based on the description of privilege escalation, it is inferred that an attacker could potentially gain full administrative control over container images, registry configuration, and any secrets stored within the registry, which could compromise confidentiality, integrity, and availability for affected workloads.

The vulnerability affects Microsoft Azure Container Registry. Specific version information is not provided in the CVE; therefore all instances of Azure Container Registry that have not yet applied the vendor’s patch are considered at risk until a fix is deployed.

The CVSS score of 10 indicates critical severity. The EPSS score of < 1% suggests a low current probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote over a network, most likely via the registry’s API, as the description notes an authorization bypass occurring over a network. Despite the low exploitation likelihood, the high severity warrants immediate attention to prevent a potential privilege escalation that could impact entire environments.