EUVD-2026-54320
GHSA-jc4p-jq54-67w6
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Authenticated low-priv network attacker (PR:L, AV:N, AC:L) with scope change across the multi-tenant boundary; description emphasizes disclosure so C:H, integrity downgraded to I:L pending vendor confirmation, A:N.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Lifecycle Timeline
2DescriptionCVE.org
Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a network.
AnalysisAI
Information disclosure in Microsoft Azure Logic Apps allows an authenticated, low-privileged attacker to read data they should not have access to across a network, with a scope-changed CVSS 3.1 score of 9.6 reflecting potential cross-boundary (multi-tenant) impact. The flaw stems from improper access control (CWE-284) in the cloud workflow-automation service; Microsoft is the reporter and remediation is delivered service-side. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to be authenticated with at least low privileges (PR:L) and to have network reachability to the Azure Logic Apps service (AV:N); no user interaction is required (UI:N) and attack complexity is low (AC:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N = 9.6 Critical) signals a network-exploitable, low-complexity flaw requiring only low privileges and no user interaction, with scope change amplifying the score - a genuinely high theoretical priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who already holds a low-privileged, authenticated foothold in an Azure environment (e.g., a limited user or compromised service principal) sends crafted network requests to the Logic Apps service to reach resources outside their authorized scope. Because the scope-changed vector implies a cross-boundary effect, they retrieve sensitive workflow data, run history, or connector information belonging to another authorization boundary. … |
| Remediation | Because Azure Logic Apps is a Microsoft-operated cloud service, the primary remediation is applied server-side by Microsoft and requires no customer action for the hosted (Consumption/multi-tenant) offering - no vendor-released customer-installable patch version is identified in the available data, so track the official fix status via the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56161. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: conduct a complete inventory of Azure Logic Apps in your environment and identify which handle sensitive, regulated, or confidential data that must not be exposed to other organizations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Azure Logic Apps
View allPrivilege escalation in Microsoft Azure Logic Apps allows an authenticated attacker with low-level privileges to elevate
Privilege escalation in Azure Logic Apps results from improper path validation, enabling remote attackers to gain elevat
Microsoft Power Platform Connector Spoofing Vulnerability. Rated high severity (CVSS 7.4), this vulnerability is remotel
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today