Microsoft Bookings
Monthly
Authorization bypass in Microsoft Bookings allows unauthenticated remote attackers to elevate privileges by manipulating user-controlled keys. The flaw, tracked as CVE-2026-94510, stems from an insecure direct object reference (CWE-639) and carries a CVSS 3.1 base score of 9.9 due to scope change and high integrity impact. No public exploit code is known to be circulating, and Microsoft has applied a server-side patch to the hosted service.
Authorization bypass in Microsoft Bookings allows unauthenticated remote attackers to elevate privileges by manipulating user-controlled keys. The flaw, tracked as CVE-2026-94510, stems from an insecure direct object reference (CWE-639) and carries a CVSS 3.1 base score of 9.9 due to scope change and high integrity impact. No public exploit code is known to be circulating, and Microsoft has applied a server-side patch to the hosted service.