CVE-2026-33103
Improper Access Control in Microsoft Dynamics 365 Leads to Data Disclosure
Publication date: 2026-04-14
Last updated on: 2026-04-28
Assigner: Microsoft Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| microsoft | dynamics_365 | From 9.0 (inc) to 9.1.44.15 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability involves improper access control that allows an authorized attacker to disclose information locally in Microsoft Dynamics 365 (on-premises).
Such information disclosure could potentially impact compliance with data protection standards and regulations like GDPR and HIPAA, which require strict controls to prevent unauthorized access to sensitive information.
However, the provided information does not specify the exact nature of the data disclosed or the compliance implications.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, it is important to apply the latest security updates provided by Microsoft for Dynamics 365 (on-premises).
Since the issue is improper access control allowing local information disclosure by authorized users, reviewing and tightening access permissions for users in Dynamics 365 can help reduce risk.
Can you explain this vulnerability to me?
This vulnerability is an improper access control issue in Microsoft Dynamics 365 (on-premises). It allows an authorized attacker to locally disclose information that they should not have access to.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized disclosure of sensitive information by an attacker who already has some level of access. This could result in exposure of confidential data, potentially harming privacy and security.