The vulnerability is a server‑side request forgery (SSRF) in Microsoft SharePoint. An attacker with legitimate authorisation can trick SharePoint into making HTTP requests to arbitrary URLs, potentially retrieving sensitive internal information. Because the flaw only allows disclosure and not code execution, the direct impact is information leakage. The CWE‑918 classification confirms it is an SSRF risk.

Microsoft SharePoint Server Subscription Edition is affected. No specific version numbers are provided in the advisory, so the vulnerability may exist across multiple releases until a patch is issued.

The CVSS score of 3.5 indicates low severity, and the exploitation probability is unknown as no EPSS value is available. The vulnerability is not listed in the CISA KEV catalog. An attacker must already have authenticated access to the SharePoint instance to exploit the flaw. Because the ability is limited to information disclosure, the attack would likely be used in reconnaissance or lateral movement rather than delivering a payload, and the overall risk to the organization remains moderate but actionable.