Improper access control in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. The flaw permits authenticated users to access data beyond their intended scope, potentially revealing sensitive documents, configuration settings, or user information. This breach can compromise confidentiality and expose internal resources to external observers, undermining trust and regulatory compliance.

The vulnerability affects Microsoft SharePoint Server Subscription Edition. No specific affected versions are listed, so all installations of this product may be at risk until a patch is applied.

The CVSS score of 4.9 indicates moderate severity, and the EPSS score is not available, suggesting limited exploitation data at present. The flaw requires an authorized attacker, so the attack vector is likely an authenticated internal network scenario. While not listed in KEV, the vulnerability is not widely exploited yet; however, the impact on confidentiality necessitates timely remediation and monitoring.