What is the CVSS score of CVE-2026-59118?

CVE-2026-59118 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Microsoft Power Apps are affected by CVE-2026-59118?

Microsoft Power Apps contains a critical privilege elevation vulnerability (CVE-2026-59118, CVSS 9.3) that allows unauthenticated network attackers to gain unauthorized elevated permissions through…

How to fix or mitigate CVE-2026-59118?

Within 24 hours: inventory all Microsoft Power Apps deployments and user populations; prepare a communication plan for affected teams and leadership. Within 7 days: implement network segmentation or access restrictions to Power Apps if operationally feasible; enable enhanced monitoring and logging for Power Apps authentication and privilege escalation attempts; establish an incident response workflow specific to this vulnerability. Within 30 days: maintain active watch for vendor patch release from Microsoft (monitor Microsoft Security Update Guide and CVE advisories); conduct tabletop exercise on response and rollout procedures for when patch becomes available; evaluate whether organizational Power Apps workloads can be isolated or decommissioned pending patch availability.

Microsoft Power Apps CVE-2026-59118

EUVD-2026-54314 CRITICAL

Improper Authorization (CWE-285)

2026-08-07 secure@microsoft.com

GHSA-jc2g-2frr-2pxq

Authentication Bypass Microsoft Power Apps

9.3

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

ENISA EUVD

HIGH

qualitative

vuln.today AI

9.3 CRITICAL

Network-reachable authorization bypass needing no privileges but victim interaction (UI:R); cross-boundary impact justifies S:C with high C/I and no availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 00:32 vuln.today

CVE Published

Aug 07, 2026 - 00:16 nvd

CRITICAL 9.3

DescriptionCVE.org

Improper authorization in Microsoft Power Apps allows an unauthorized attacker to elevate privileges over a network.

AnalysisAI

Privilege elevation in Microsoft Power Apps allows an unauthorized, network-based attacker to gain elevated permissions by abusing improper authorization checks, with a scope change (S:C) indicating the impact crosses a security boundary beyond the initially compromised component. Exploitation requires some user interaction (UI:R) but no prior authentication (PR:N), and results in high confidentiality and integrity impact. At time of analysis there is no public exploit identified and the issue is not listed in CISA KEV; the CVSS base score is 9.3 (Critical).

Technical ContextAI

Microsoft Power Apps is a low-code application development platform within the Microsoft Power Platform, used to build business web and mobile apps that connect to data via Dataverse and hundreds of connectors, typically delivered as a multi-tenant Microsoft-hosted cloud service. The root cause is CWE-285 (Improper Authorization): the service fails to correctly verify that a requesting principal is permitted to perform an action or access a resource, allowing an actor to act with permissions they should not hold. The CVSS scope change (S:C) is consistent with a cloud/multi-tenant authorization flaw where the vulnerable authorization component and the impacted resources fall under different security authorities - for example crossing between application context and underlying data or between tenants/users. No CPE list was provided in the input, so exact affected build identifiers are not enumerable from this data.

RemediationAI

Because Microsoft Power Apps is a Microsoft-hosted cloud service, the fix is expected to be applied server-side by Microsoft rather than requiring a customer-installed update; no customer-specific fix version was provided in the input (Patch available per vendor advisory - released patched version not independently confirmed). Administrators should consult the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-59118 to confirm whether any customer action, connector reconfiguration, or environment setting change is required. As interim compensating controls where feasible, restrict Power Apps sharing to least privilege, review environment and Dataverse security roles for over-broad access, enforce conditional access and MFA on Power Platform, and audit recent app-sharing and permission changes for anomalous access - noting these controls reduce blast radius but do not themselves remediate the underlying authorization flaw. Do not rely on version-based patching claims not present in the vendor advisory.