A vulnerable component of Microsoft SharePoint Server Subscription Edition fails to neutralize user input when generating web pages, creating a cross‑site scripting flaw. This flaw permits an attacker who already has authorized access to the system to inject malicious content so that users are shown forged information, effectively performing a spoofing attack. The vulnerability could allow the attacker to alter the appearance or behavior of the SharePoint site without affecting the authentication or authorization mechanisms of the host system; the primary consequence is the misrepresentation of legitimate content to other users.

Microsoft SharePoint Server Subscription Edition. No specific version details are provided, so all currently deployed instances of this edition are potentially affected unless a patch is applied.

The CVSS score of 4.6 indicates a moderate risk level, and the EPSS score is unavailable, suggesting limited publicly known exploitation. The vulnerability requires that the attacker already has authorized privileges to the SharePoint environment, which limits its feasibility to insiders or compromised accounts. Because the flaw facilitates spoofing rather than direct remote code execution or data exfiltration, the likelihood of widespread, high‑impact exploitation is lower, and the vulnerability is not listed in CISA’s KEV catalog.