CVE-2025-24989
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Lifecycle Timeline
4Description
An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control. This vulnerability has already been mitigated in the service and all affected customers have been notified. This update addressed the registration control bypass. Affected customers have been given instructions on reviewing their sites for potential exploitation and clean up methods. If you've not been notified this vulnerability does not affect you.
Analysis
Microsoft Power Pages contains an improper access control vulnerability allowing unauthenticated attackers to elevate privileges and bypass user registration controls over the network.
Technical Context
The CWE-284 access control flaw in Power Pages' registration system allows attackers to bypass the intended user registration flow, creating accounts with elevated privileges beyond what the registration process should allow.
Affected Products
['Microsoft Power Pages']
Remediation
Microsoft has already mitigated this in the service. Review Power Pages user accounts for unauthorized registrations. Verify that registration controls are properly configured.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today