What happened
A vulnerability has been identified in Microsoft SharePoint Server Subscription Edition, characterised by missing authorization checks. This flaw allows an attacker with low-level, network-accessible permissions to elevate their privileges within affected deployments. The vulnerability is deemed high severity, with an CVSS score of 8.8, as it enables privilege escalation with high potential for impact. The issue arises from inadequate access control within the SharePoint component, specifically affecting versions from 16.0.0 up to, but not including, 16.0.20326.20190. The vulnerability was reported by NVD and confirmed through authoritative sources. Exploitation conditions include accessible network services, the requirement for only low-privileged accounts, and no user interaction or additional action. Attackers can exploit this flaw directly over a network, by targeting exposed services, which increases the risk if those services are not properly secured. Who is affected Organisations running Microsoft SharePoint Server Subscription Edition, particularly those deploying versions affected by the vulnerability, are at potential risk. Any deployment with exposed services accessible over a network may be vulnerable if proper access controls and network protections are not in place. The vulnerability affects systems where the service is reachable remotely and where low-privileged accounts can interact with the vulnerable components. Recommended actions
Implement network protections such as segmentation and access controls around SharePoint services to reduce exposure to untrusted entities. Review and tighten access permissions, especially for low-privileged accounts with network access to SharePoint servers. Monitor network traffic and access logs for unusual activity targeting the affected services. Apply available updates or patches once they are released; stay informed from official sources.
