CVE-2026-120002

Summary

A flaw in Microsoft Office SharePoint's authorization logic allows an authenticated, low-privilege user to gain elevated privileges over the network due to improper access control checks. This enables unauthorized administrative actions or data access beyond the user's assigned permissions.

Exploitability

Exploitation requires valid credentials and low-privilege access; no authentication bypass is needed, but the attacker must craft specific requests targeting the flawed authorization path.

Blast radius

Successful exploitation could lead to full compromise of SharePoint data and services, including unauthorized modification or exfiltration of sensitive documents and user accounts.

Detection

Monitor SharePoint ULS logs for anomalous privilege escalation patterns, such as a user with minimal permissions performing actions reserved for Site Collection Administrators (e.g., modifying site permissions, creating new site collections, or accessing /_admin URLs without elevated context).

Prioritized remediation

Apply Microsoft security update released for CVE-2026-120002; if no fixed version is specified in public advisories, restrict network access to SharePoint administrative endpoints to trusted IP ranges and enforce strict role-based access control policies pending patching.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.