A flaw in the authorization logic of Microsoft SharePoint Server Subscription Edition allows an attacker who already has authorized access to elevate privileges across the network. The weakness is an imprecise authorization check (CWE-863). If exploited, the attacker could gain higher privileges than intended, enabling unauthorized actions, data exposure, or further network compromise.

Microsoft SharePoint Server Subscription Edition is affected. No specific version information is available, so all existing releases should be considered potentially vulnerable until a patch is applied.

The CVSS score of 8.8 indicates a high severity vulnerability. While the EPSS score is not available, the lack of a KEV listing suggests no publicly disclosed exploits at the time of this analysis. The attack requires the attacker to be already authenticated to the system and have network access, but once authenticated, they could abuse the authorization flaw to gain more extensive privileges.