A missing authorization check in the WebDAV protocol allows an attacker who already has legitimate credentials to bypass a security feature when communicating over a network. This flaw enables the attacker to access protected resources or perform privileged actions beyond the intended allowance, potentially leading to unauthorized data exposure or modification.

The vulnerability affects a range of Microsoft Windows operating systems, including Windows 10 versions 1607, 1809, 21H2, 22H2, Windows 11 builds 23H2, 24H2, 25H2, 26H2, and various Windows Server releases from 2012 through 2025, both standard and Server Core installations.

With a CVSS score of 6.5 the flaw carries moderate severity. No EPSS score is reported, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread exploitation. The attack requires an authenticated session and can be carried out over the network using standard WebDAV requests. While the likelihood of exploitation is not quantified, the ability to lift a security feature presents a meaningful risk to systems that rely on WebDAV for access control.