Product:
Power Automate
Summary
Exposure of sensitive information to an unauthorized actor in Power Automate allows an authorized attacker to disclose information over a network. This vulnerability can lead to significant confidentiality breaches. It is crucial for users to understand the risks associated with this issue.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.5 | CVE-2026-40374 |
Exploitation
An attacker can exploit this vulnerability by leveraging their authorized access to Power Automate to disclose sensitive information over the network. Since the attack complexity is low and does not require user interaction, it makes it easier for attackers to exploit this vulnerability if they have the necessary privileges.
Affected Products
- Power Automate: A cloud-based service that helps automate workflows and tasks.
Mitigation
To mitigate this vulnerability, it is recommended that users review their access controls and ensure that only authorized personnel have access to sensitive information within Power Automate. Regular audits and monitoring of user activities can also help in identifying any unauthorized access attempts.