Product:
M365 Copilot
Summary
Improper access control in M365 Copilot allows an authorized attacker to perform spoofing locally. This vulnerability can lead to unauthorized actions being taken by the attacker within the system. It is crucial for users to be aware of the potential risks associated with this issue.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.4 | CVE-2026-41100 |
Exploitation
To exploit this vulnerability, an attacker with authorized access can manipulate the access controls within M365 Copilot. By doing so, they can perform spoofing attacks locally, potentially leading to unauthorized actions or data exposure. The low attack complexity means that even users with minimal technical skills could exploit this vulnerability if they have the necessary access.
Affected Products
- M365 Copilot: Affected by improper access control allowing local spoofing.
Mitigation
To mitigate this vulnerability, it is recommended that users ensure proper access controls are in place and regularly review permissions associated with M365 Copilot. Keeping the software updated and monitoring for any unusual activity can also help reduce the risk of exploitation.