Microsoft Fabric
Monthly
Privilege elevation in Microsoft Fabric lets an authenticated, low-privileged user abuse a relative path traversal weakness (CWE-23) over the network to reach resources outside their intended scope and gain higher privileges. Microsoft rates this CVSS 9.9 with a scope change, reflecting that a compromised tenant identity can cross authorization boundaries in the multi-tenant analytics platform. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the near-maximum score and low attack complexity make it a high-priority fix.
Privilege elevation in Microsoft Fabric lets an authenticated, low-privileged user abuse a relative path traversal weakness (CWE-23) over the network to reach resources outside their intended scope and gain higher privileges. Microsoft rates this CVSS 9.9 with a scope change, reflecting that a compromised tenant identity can cross authorization boundaries in the multi-tenant analytics platform. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the near-maximum score and low attack complexity make it a high-priority fix.