Description

Authorization bypass through user-controlled key in Microsoft Partner Center allows an unauthorized attacker to disclose information over a network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-08-20T22:18:00.610Z",
  "pubdate": "2026-08-20T22:18:00.610Z",
  "executiveSummary": "An authorization bypass vulnerability exists in Microsoft Partner Center, specifically stemming from the handling of user-controlled keys. This security flaw allows an unauthorized remote attacker to successfully execute a network-based attack resulting in the unauthorized disclosure of sensitive information. The vulnerability exposes core functionalities and data repositories that should otherwise be strictly partitioned and accessible solely to authenticated and authorized entities. From a risk perspective, this flaw undermines the confidentiality guarantees of the platform, potentially exposing proprietary partner data and internal system identifiers. The attack capabilities require no prior authentication or specialized privileges, lowering the barrier to entry for malicious actors operating over the network. Exploitation relies on manipulating user-controlled parameters or keys during the request lifecycle to bypass access control checks enforced by the application layer. No specific complex interaction or physical access is required, as the flaw is entirely exploitable via network vectors targeting the vulnerable endpoint.",
  "technicalDetails": "The root cause of the vulnerability resides in flawed access control logic within Microsoft Partner Center, specifically failing to properly validate user-supplied keys against the authorized session context or identity claims. When a client issues a request containing a user-controlled key or parameter, the underlying application logic trusts this input implicitly or fails to perform adequate server-side authorization checks to verify whether the requesting entity possesses the necessary privileges to access the requested resource. The vulnerable component involves the authorization middleware and routing handlers responsible for processing object references and access keys within the service architecture. Attack flow begins when an unauthenticated or low-privileged attacker crafts a malicious HTTP request directed at the exposed network service. By manipulating the user-controlled key parameter within the request payload or URI path, the attacker induces the application to resolve and return data associated with arbitrary accounts or internal objects. The server processes the manipulated key without verifying ownership or authorization scope, leading to an insecure direct object reference (IDOR) or broken object level authorization (BOLA) condition. Consequently, the backend retrieves the requested data and returns it in the response body to the unauthorized client. Post-exploitation impact is characterized by the unauthorized disclosure of sensitive information over the network, which may include confidential partner records, internal metadata, and personally identifiable information depending on the scope accessible via the manipulated keys. The vulnerability is exploitable remotely over the network without requiring authentication or prior privileges, presenting a significant security risk to multi-tenant cloud environments."
}