What is the CVSS score of CVE-2026-56161?

CVE-2026-56161 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Azure Logic Apps are affected by CVE-2026-56161?

A critical access control flaw in Microsoft Azure Logic Apps allows authenticated users to read confidential data belonging to other customers and tenants, creating significant cross-organizational…

How to fix or mitigate CVE-2026-56161?

Within 24 hours: conduct a complete inventory of Azure Logic Apps in your environment and identify which handle sensitive, regulated, or confidential data that must not be exposed to other organizations. Within 7 days: enable comprehensive access logging for all Logic Apps through Azure Monitor, restrict Logic Apps to non-sensitive workflows only, and audit all role-based access control (RBAC) assignments to enforce least-privilege principles across your tenant. Within 30 days: monitor Microsoft security bulletins and official advisories for confirmation that service-side remediation has been deployed, then conduct validation testing to verify data isolation and cross-tenant boundaries are restored.

Azure Logic Apps CVE-2026-56161

EUVD-2026-54320 CRITICAL

Improper Access Control (CWE-284)

2026-08-07 secure@microsoft.com

GHSA-jc4p-jq54-67w6

Authentication Bypass Microsoft Azure Logic Apps

9.6

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

ENISA EUVD

HIGH

qualitative

vuln.today AI

8.5 HIGH

Authenticated low-priv network attacker (PR:L, AV:N, AC:L) with scope change across the multi-tenant boundary; description emphasizes disclosure so C:H, integrity downgraded to I:L pending vendor confirmation, A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 00:31 vuln.today

CVE Published

Aug 07, 2026 - 00:16 nvd

CRITICAL 9.6

DescriptionCVE.org

Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a network.

AnalysisAI

Information disclosure in Microsoft Azure Logic Apps allows an authenticated, low-privileged attacker to read data they should not have access to across a network, with a scope-changed CVSS 3.1 score of 9.6 reflecting potential cross-boundary (multi-tenant) impact. The flaw stems from improper access control (CWE-284) in the cloud workflow-automation service; Microsoft is the reporter and remediation is delivered service-side. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, though the high score and scope change warrant prompt attention.

Technical ContextAI

Azure Logic Apps is Microsoft's cloud-based integration and workflow-automation platform (part of Azure App Service / integration services) used to build automated workflows that connect apps, data, services, and systems, often processing sensitive business data and credentials via connectors. The root cause is classified as CWE-284 (Improper Access Control), meaning the service fails to correctly enforce authorization checks on a network-reachable operation. The CVSS scope-changed flag (S:C) indicates the vulnerable component's authorization boundary differs from the impacted resources - consistent with a multi-tenant SaaS platform where a flaw can expose data belonging to another security authority (e.g., another workflow, subscription, or tenant). Exact affected components, APIs, or connector paths are not disclosed in the available data, as Microsoft treats cloud-service internals as opaque.

RemediationAI

Because Azure Logic Apps is a Microsoft-operated cloud service, the primary remediation is applied server-side by Microsoft and requires no customer action for the hosted (Consumption/multi-tenant) offering - no vendor-released customer-installable patch version is identified in the available data, so track the official fix status via the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56161. As compensating controls while confirming Microsoft's fix, tighten the blast radius of the low-privilege access the vector requires: apply least-privilege Azure RBAC and scope Logic Apps managed-identity and connector permissions to only necessary resources (side effect: may break workflows relying on broad permissions), restrict access to Logic App HTTP request triggers and management endpoints using IP restrictions/private endpoints and Azure API Management (side effect: added latency and configuration overhead), and enable Azure Monitor / diagnostic logging and Microsoft Defender for Cloud alerts to detect anomalous access to workflow run history and outputs. Rotate any secrets or connector credentials that may have been exposed if you observe suspicious access.