{"id":"CVE-2026-120002","published":"2026-11-10T19:20:26.080","lastModified":"2026-11-10T19:20:26.207","description":"Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-863"],"vendors":[],"products":[],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-120002","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A flaw in Microsoft Office SharePoint's authorization logic allows an authenticated, low-privilege user to gain elevated privileges over the network due to improper access control checks. This enables unauthorized administrative actions or data access beyond the user's assigned permissions.","exploitability":"Exploitation requires valid credentials and low-privilege access; no authentication bypass is needed, but the attacker must craft specific requests targeting the flawed authorization path.","blast_radius":"Successful exploitation could lead to full compromise of SharePoint data and services, including unauthorized modification or exfiltration of sensitive documents and user accounts.","remediation":"Apply Microsoft security update released for CVE-2026-120002; if no fixed version is specified in public advisories, restrict network access to SharePoint administrative endpoints to trusted IP ranges and enforce strict role-based access control policies pending patching.","detection":"Monitor SharePoint ULS logs for anomalous privilege escalation patterns, such as a user with minimal permissions performing actions reserved for Site Collection Administrators (e.g., modifying site permissions, creating new site collections, or accessing /_admin URLs without elevated context).","tags":["auth-bypass","privilege-escalation","sharepoint","network","cwe-863"],"model":"garnet-coder","analyzedAt":"2026-11-11T09:45:48.814Z"}}