EUVD-2026-70792
GHSA-cxfp-3qwv-3cv4
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-accessible SaaS requiring only a valid low-privileged account (PR:L); low complexity and no interaction needed; full C/I/A impact on successful privilege escalation within the tenant boundary.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
Missing authorization in Microsoft Fabric allows an authorized attacker to elevate privileges over a network.
AnalysisAI
Privilege escalation in Microsoft Fabric allows an authenticated low-privileged attacker to elevate their access level over the network, gaining full control over confidentiality, integrity, and availability of affected resources. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms low-friction network exploitation requiring only a valid user account and no additional interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid, low-privileged authenticated account on the target Microsoft Fabric tenant (PR:L per the CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 score reflects high technical impact across confidentiality, integrity, and availability with low attack complexity and only low-privilege authentication required, making this a realistic internal threat for any multi-user Fabric tenant. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | As a SaaS platform, Microsoft Fabric is patched and operated by Microsoft; customer-side version upgrades are not applicable. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all Microsoft Fabric workspaces and catalog users with low-privileged access; determine which users have access to sensitive business data and assess insider risk. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Hyperledger Fabric 2.3 allows attackers to cause a denial of service (orderer crash) by repeatedly sending a crafted cha
A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.1.0. Rated high severity (CVSS 7.5), this vul
Hyperledger Fabric is an open source permissioned distributed ledger framework. Rated medium severity (CVSS 6.5), this v
Local file inclusion in the Fabric WordPress theme (≤1.5.0) allows unauthenticated attackers to include arbitrary PHP fi
Hyperledger Fabric is a permissioned distributed ledger framework. Rated high severity (CVSS 7.5), this vulnerability is
A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.0.1, v2.3.0. Rated high severity (CVSS 7.5),
danielmiessler fabric through 1.3.0 allows installer/client/gui/static/js/index.js XSS because of innerHTML mishandling,
Hyperledger Fabric through 3.0.0 and 2.5.x through 2.5.9 do not verify that a request has a timestamp within the expecte
Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applica
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today