Microsoft PowerToys contains a weakness in its authentication mechanism that permits an attacker with access to a local user account to tamper with the application’s configuration or functionality. The flaw is classified as CWE‑1390, indicating unauthorized modification of protected data. The vulnerability allows a legitimate attacker to alter settings or behavior without triggering additional authentication checks, potentially impacting integrity of the user environment.

The affected product is Microsoft PowerToys. No specific version range is listed, so all installations of PowerToys may be susceptible until an official patch is applied.

The CVSS score of 5.5 indicates a moderate severity. Exploitation requires the attacker to already possess authorized local credentials, so the attack surface is limited to the local machine. The EPSS score is not available, and the issue is not yet listed in CISA’s KEV catalog, suggesting that widespread exploitation is unlikely at present. Nonetheless, because the flaw can modify application behavior, it should be addressed promptly to maintain the integrity of the user’s setup.