Product:
Microsoft Dynamics 365
Summary
Improper access control in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to disclose information locally. This vulnerability can lead to unauthorized information exposure, impacting the confidentiality of sensitive data. It is crucial for organizations using this product to be aware of the potential risks associated with this issue.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.5 | CVE-2026-33103 |
Exploitation
To exploit this vulnerability, an attacker with authorized access can manipulate the access controls within Microsoft Dynamics 365. By doing so, they can gain unauthorized access to sensitive information stored locally. The low attack complexity means that even users with minimal technical skills could potentially exploit this flaw if they have the necessary permissions.
Affected Products
- Microsoft Dynamics 365 (on-premises): Affected by improper access control, allowing information disclosure.
Mitigation
To mitigate this vulnerability, organizations should review and strengthen their access control policies within Microsoft Dynamics 365. Regular audits and updates to user permissions can help prevent unauthorized access. Additionally, applying any available security updates from Microsoft is essential to protect against this and other vulnerabilities.