Executive brief
Microsoft Fabric is a cloud analytics platform that integrates data warehousing and business intelligence capabilities. A missing authorization control allows an authenticated attacker to escalate their privileges and gain unauthorized access to higher-level resources or functions within the platform, potentially compromising data integrity and access controls.
Technical details
This vulnerability involves missing authorization checks in Microsoft Fabric, enabling privilege escalation. An authenticated attacker can bypass authorization controls to perform actions or access resources beyond their assigned permissions. The attack requires network access and an existing valid account within Fabric. A successful exploit allows an attacker to elevate their privileges and potentially access sensitive data or administrative functions. A security patch addressing this authorization bypass is expected from Microsoft.
Affected products
- Microsoft Fabric
Timeline
- 2026-09-03: disclosed