Microsoft Office SharePoint Server contains a server‑side request forgery (SSRF) flaw that lets an attacker who already has legitimate access to the SharePoint instance send arbitrary HTTP requests to internal network resources. By leveraging this SSRF ability, the attacker can cause the SharePoint server to reach privileged endpoints, thereby elevating the privileges of the SharePoint service or other accounts on the same system and compromising confidentiality, integrity, and availability.

Microsoft SharePoint Server Subscription Edition is the affected product. No specific version information is provided in the CVE data.

The flaw is rated with a CVSS score of 7.5, indicating high severity. The EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker must already have legitimate access to the SharePoint instance to exploit this SSRF. The likely attack vector is an authorized attacker who can drive internal requests from the SharePoint server, giving the attacker network‑level access and control over privileged resources.