CVE-2026-73298
Received Received - Intake

Authenticated IDOR in Microsoft Container Migration Solution Accelerator

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description
The Microsoft Container Migration Solution Accelerator is a multi-service application that provides a multi-agent, AI-driven migration solution for moving container service configurations to Azure Kubernetes Service. In version 2.1.2 and earlier, a security vulnerability was identified in the Container Migration Solution Accelerator, specifically an authenticated IDOR (Insecure Direct Object Reference) that allows users to read, write, and delete processes belonging to other authenticated users. The issue affects multiple API endpoints, where ownership checks are missing, enabling unauthorized access and modification of migration data across users within the same organization. The vulnerability is present in both process and file management APIs, and the application relies on Entra ID authentication but lacks proper authorization controls between users. Authenticated users are able to access, modify, and delete processes and files belonging to other users without proper authorization checks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-12
Generated
2026-08-13
AI Q&A
2026-08-12
EPSS Evaluated
N/A
NVD
CVE-2026-73298
EUVD
EUVD-2026-57371

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
microsoft container_migration_solution_accelerator to 2.1.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-73298 is an authenticated Insecure Direct Object Reference (IDOR) vulnerability in the Microsoft Container Migration Solution Accelerator affecting versions 2.1.2 and earlier. It allows authenticated users to read, write, or delete processes and files belonging to other users within the same organization due to missing ownership checks in API endpoints.

Detection Guidance

To detect this vulnerability, inspect API endpoints for missing ownership checks in the Container Migration Solution Accelerator. Check if authenticated users can access or modify processes/files belonging to others. Review logs for unauthorized access attempts to /api/v4/team_configs endpoints or similar paths.

Impact Analysis

An attacker with valid credentials could access, modify, or delete another user's migration data, potentially disrupting migration processes or leaking sensitive information. This could lead to data loss, unauthorized changes, or service disruption within the affected organization.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized access to sensitive data, potentially leading to breaches of confidentiality and integrity. Organizations may face penalties under GDPR for data exposure or HIPAA for unauthorized access to protected health information.

Mitigation Strategies

Upgrade to version 2.1.2 or later to apply fixes. Implement object-level authorization checks in all API endpoints. Ensure database queries include user_id filtering. Verify delete workflows validate ownership before processing. Add authorization regression tests to prevent recurrence.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73298. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart