This vulnerability is a missing authorization flaw that allows an attacker who already has authorized access to the SharePoint environment to elevate their privileges over the network. The weakness is classified as CWE‑862 and could enable the attacker to gain higher‑level permissions, potentially compromising system integrity and confidentiality. It does not directly allow arbitrary code execution but can lead to full control of the SharePoint instance if the attacker is able to obtain a higher‑privilege account.

Microsoft SharePoint Server Subscription Edition is the affected product. The CVE entry does not specify particular patch levels or version numbers, so all subscription edition deployments are potentially vulnerable until patched.

The CVSS score of 8.8 indicates a high severity risk. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack is likely to occur via network traffic between clients and the SharePoint server, where an attacker with authenticated access could manipulate authorization controls to increase privileges. Given the lack of exploitation data, the actual exploit probability is uncertain, but the high CVSS score warrants immediate attention.