The vulnerability in Microsoft SharePoint Server Subscription Edition allows an authenticated attacker to increase their privileges by exploiting a flaw in the platform's authorization logic. An attacker who already has some level of access can elevate their rights to an administrator level, giving them the ability to perform actions beyond their original permissions. This severity compromises confidentiality, integrity, and availability of the SharePoint environment.

All deployments of Microsoft SharePoint Server Subscription Edition are potentially impacted. No specific product versions have been listed in the CNA data, so every version of this edition is considered vulnerable until a patch is applied.

The CVSS base score of 8.8 indicates high severity. The EPSS score of less than 1% signifies a very low, but non‑zero, probability of exploitation. This flaw requires an authorized attacker, so the attack vector is network local and relies on an existing user account. Because the issue is not listed in CISA KEV, stakeholders should still treat it with caution and prioritize patching to eliminate the privilege escalation risk.