EUVD-2026-99048
GHSA-v78q-mf5c-4g26
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege SharePoint account
-
ExploitSend crafted request over network
-
ExecutionTrigger incorrect authorization check
-
ImpactAccess unauthorized confidential data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already hold valid low-privilege authenticated access to the SharePoint deployment (PR:L) and network reachability to the server (AV:N); no user interaction is needed (UI:N). The affected configuration is Microsoft SharePoint Server Subscription Edition at versions below 16.0.20326.20190. The limiting factor is the authentication requirement - an anonymous/external attacker with no account cannot exploit this; the realistic risk is elevated primarily in environments with many authenticated users or multi-tenant/shared SharePoint sites where cross-account data disclosure is impactful. |
| Impact | This is a moderate-severity information disclosure flaw (CVSS 6.5) rooted in CWE-863 (Incorrect Authorization). The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N is internally consistent with the description: network-reachable (AV:N), low attack complexity (AC:L), and crucially requires low-privilege authentication (PR:L) by an 'authorized attacker,' with high confidentiality impact (C:H) but no integrity or availability impact. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no positive signal of real-world exploitation - this is not confirmed to be actively exploited. The combination of required authentication (PR:L), confidentiality-only impact, and absence of exploitation evidence places this below critical-priority patching but still relevant for multi-tenant or large-user SharePoint environments where an authenticated low-privilege user could read data belonging to others. Note a signal tension worth flagging: the input 'Authentication Bypass' tag conflicts with both the CWE-863 (Incorrect Authorization) classification and the description's explicit 'authorized attacker' / PR:L requirement - this is an authorization flaw exploited by an already-authenticated user, not a bypass of authentication. Treat this as a prioritized-but-not-emergency patch given the vendor fix is available. |
| Exploit ScenarioDerived | A low-privileged but authenticated user of a SharePoint Server Subscription Edition deployment sends crafted requests over the network to resources they should not be authorized to view. Due to an incorrect authorization check, the server returns confidential information belonging to other users or sites. No public exploit code was identified at the time of analysis, and no user interaction is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Incorrect authorization in Microsoft SharePoint Server Subscription Edition (versions below 16.0.20326.20190) allows an authenticated attacker with low privileges to disclose information over the network, with no user interaction required. The flaw is rooted in CWE-863 (Incorrect Authorization), meaning the server fails to properly validate whether a user is entitled to access certain data. No public exploit code or confirmed active exploitation is identified at time of analysis for CVE-2026-102865; the limiting factor is that the attacker must already hold valid low-privilege access, so realistic risk is highest in environments with many authenticated users or multi-tenant/shared SharePoint sites where cross-account disclosure matters.
RemediationAI
Microsoft has released a vendor patch for CVE-2026-102865, and administrators should upgrade Microsoft SharePoint Server Subscription Edition to version 16.0.20326.20190 or later and follow the guidance in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102865. Because exploitation requires valid low-privilege authenticated access (PR:L), interim compensating controls should focus on reducing the blast radius: audit and minimize the number of accounts with authenticated access to sensitive SharePoint sites, tighten SharePoint permission groups and remove unnecessary site membership, and limit network reachability to the SharePoint front end to trusted networks or VPN where operationally feasible - though this last control degrades usability for legitimate remote users and is best applied as a short-term measure. Monitor SharePoint audit and access logs for anomalous cross-site or cross-account data access by low-privilege accounts until patching is complete.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability is a CWE-863 incorrect authorization weakness in Microsoft SharePoint Server Subscription Edition. Rather than an authentication bypass in the strict sense of allowing unauthenticated entry, the defect lies in authorization enforcement: a request made by an already-authenticated low-privilege user (PR:L) over the network (AV:N) can return data the user should not be permitted to read, yielding high confidentiality impact (C:H) while integrity and availability are unaffected (I:N/A:N) and the scope remains unchanged (S:U). The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N places exploitation complexity at low once the prerequisite account exists, and the absence of UI:N means no victim interaction is needed. The affected CPE/version data identifies Microsoft SharePoint Server Subscription Edition builds earlier than 16.0.20326.20190, and the ENISA EUVD entry (EUVD-2026-99048) corroborates that single affected version range. The underlying risk is an access-control logic gap in how SharePoint mediates access to site content, lists, or metadata across permission boundaries.
Know when Sharepoint gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable (AV:N) and low complexity (AC:L); an already-authorized low-privilege user is required (PR:L); confidentiality-only disclosure (C:H, I:N, A:N) within one component (S:U).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Sharepoint
View allRemote code execution in Microsoft SharePoint Server Subscription Edition (builds below 16.0.20326.20190) lets an authen
SQL injection in Microsoft SharePoint Server Subscription Edition lets an authenticated, low-privilege user send crafted
Authenticated code injection in Microsoft SharePoint (CVSS 3.1 base 8.8) allows a remote attacker holding a valid low-pr
Authenticated remote code execution in Microsoft SharePoint Server Subscription Edition (builds below 16.0.20326.20190)
Authenticated remote code execution in Microsoft SharePoint Server Subscription Edition (builds earlier than 16.0.20326.
Authenticated remote code execution is possible in Microsoft SharePoint Server Subscription Edition builds before 16.0.2
Authenticated path traversal in Microsoft SharePoint Server can be escalated to code execution over the network, allowin
Privilege escalation in Microsoft SharePoint Server Subscription Edition before build 16.0.20326.20190 allows a remote l
Privilege escalation in Microsoft SharePoint Server Subscription Edition lets an authenticated attacker who holds only a
Privilege escalation in Microsoft SharePoint Server Subscription Edition allows an authenticated remote attacker holding
Privilege elevation in Microsoft SharePoint Server Subscription Edition lets any attacker who already holds a valid low-
Privilege escalation in Microsoft SharePoint allows an authenticated low-privileged user to invoke functionality that la
Exploit-DB