The vulnerability resides in a missing authorization check within Microsoft Office SharePoint. An attacker who already has authenticated network access can exploit the flaw to elevate privileges beyond their intended scope. This authority bypass can lead to unauthorized data access, modification, or denial of service on SharePoint Server. The flaw is identified as CWE-862: Missing Authorization.

Microsoft SharePoint Server Subscription Edition is affected. No specific version range is provided, so all deployed instances of this product without the latest security update are at risk.

The CVSS score of 8.8 indicates high severity. EPSS is not available, so exploit frequency cannot be quantified, yet the vulnerability is not listed in the CISA KEV catalog, suggesting no known mass exploitation. The effect is limited to authenticated users; the attacker still needs legitimate credentials but can elevate those credentials to administrative or higher roles. The absence of a public exploit means the risk is primarily theoretical but significant; organizations should treat this as a high risk and apply the update promptly.