An origin validation error in Microsoft Power Apps allows an authorized attacker to execute arbitrary code over a network, potentially compromising the confidentiality, integrity, and availability of the affected application.

Microsoft Power Apps and Microsoft Power Apps for Android are affected. Specific version information is not provided; it is inferred that all current releases may be vulnerable until a patch is released.

The CVSS score of 8 indicates a high severity vulnerability. With no EPSS score available and not listed in CISA’s KEV catalog, the exact probability of exploitation remains unknown. The flaw can be exploited by an attacker who already has authorized access to send requests to the application, enabling remote code execution with the privileges of the application process.