EUVD-2026-48456
GHSA-w3q8-77x7-hxrq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-accessible cloud API requiring only low-privilege authentication; purely a read-side flaw with high confidentiality impact and no integrity or availability consequence.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Exposure of sensitive information to an unauthorized actor in Microsoft Graph allows an authorized attacker to disclose information over a network.
AnalysisAI
Microsoft Graph exposes sensitive information to authenticated network attackers through an information disclosure flaw classified under CWE-200. Any attacker holding a valid low-privilege credential can query the Microsoft Graph API over the network to retrieve data they should not have access to, without requiring additional user interaction or elevated rights. No active exploitation is confirmed (not in CISA KEV), and Microsoft has released an official fix; however, the high confidentiality impact and low attack complexity make this a meaningful risk for any organization relying on Microsoft 365 services.
Technical ContextAI
Microsoft Graph is Microsoft's unified RESTful API gateway for accessing data, relationships, and intelligence across Microsoft 365 services, including Azure Active Directory, Exchange Online, SharePoint, Teams, and OneDrive. The affected product is identified by CPE cpe:2.3:a:microsoft:microsoft_graph:*:*:*:*:*:*:*:*, indicating all versions of the Graph API service are potentially in scope. The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), a class of flaw in which an API or service returns more data than the caller's authorization level should permit - commonly caused by insufficient access-control enforcement on API responses, over-permissive Graph permission scopes, or inadequate filtering of response payloads. Because Microsoft Graph is a cloud-hosted, multi-tenant service, the flaw lives in Microsoft's infrastructure rather than customer-deployed software.
RemediationAI
Microsoft has released a patch per the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49159. Because Microsoft Graph is a cloud service managed by Microsoft, the fix is applied server-side and no customer-deployed software upgrade is required in most cases - customers should verify their Microsoft 365 tenants are receiving the updated service. Organizations should review Microsoft Graph API permission scopes granted to registered applications, revoke overly broad permissions (especially read-all scopes such as User.Read.All, Mail.Read, Files.Read.All) that are not operationally necessary, and audit OAuth tokens and service principals for least-privilege compliance. Enabling Microsoft Entra ID Conditional Access policies to restrict Graph API access to managed and compliant devices can reduce the attack surface in the interim. Note that permission scope reduction may break integrations relying on broad access - test in a staging tenant before production rollout.
More in Microsoft Graph
View allSame weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today