This vulnerability is an authorization bypass that allows an attacker to gain elevated privileges in Microsoft Bookings by executing a request with a user‑controlled key. The flaw is a classic example of CWE‑639, where user‑controlled data is used to override an authorization decision. The impact can range from unauthorized creation of bookings to complete control over the service, compromising confidentiality, integrity, and availability of the data managed by Bookings.

The affected product is Microsoft Bookings, part of the Microsoft 365 suite. No specific version information is provided in the CVE record, so all deployments of Bookings may be impacted until a fix is applied.

The CVSS score of 9.9 indicatesSS score is not available, meaning the likelihood of exploitation is unknown from that metric. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be over the network, where an attacker supplies a crafted key value within an API request to bypass authorization checks. The flaw does not require additional privileges or local access, making it potentially exploitable by remote actors with internet access to the Bookings service. Because the issue is an authorization bypass, the impact is high if an attacker succeeds.