{"id":"CVE-2026-109455","kind":"vulnerability","aliases":["CVE-2026-109455"],"related":[],"title":"Microsoft SharePoint: incorrect authorization lets an authorized user read data","description":"Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.","summary":"Microsoft Office SharePoint has an incorrect authorization check that lets an attacker who already has an account read information they should not see over the network. The sources give no further detail on what data is exposed.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Microsoft Office SharePoint","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["microsoft-office","sharepoint","vendor"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:18:14+00:00","first_seen_at":"2026-11-10T19:24:23+00:00","triaged_at":"2026-11-10T19:58:08+00:00","updated_at":"2026-11-10T19:58:08+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-11-10T19:58:08Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft SharePoint: incorrect authorization lets an authorized user read data","impact":"low","summary":"Microsoft Office SharePoint has an incorrect authorization check that lets an attacker who already has an account read information they should not see over the network. The sources give no further detail on what data is exposed.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["sharepoint","microsoft-office"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"authorized attacker reads information over the network","analyst_note":"Check the Microsoft Security Response Center entry for CVE-2026-109455 for affected versions, fixed builds and any configuration conditions.","how_to_check":"unknown","plain_action":"","product_name":"Microsoft Office SharePoint","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000641,"input_tokens":4493,"output_tokens":383,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-109455':13A,16A '-2026':12A,15A 'account':41B 'allow':68C 'alreadi':38B 'attack':36B,71C 'author':4A,7A,31B,63C,70C 'check':32B 'cve':11A,14A 'data':10A,59B 'detail':56B 'disclos':73C 'expos':61B 'give':53B 'incorrect':3A,30B,62C 'inform':43B,74C 'let':5A,34B 'microsoft':1A,17A,21B,25B,65C 'microsoft-offic':20B 'network':50B,77C 'offic':22B,26B,66C 'office':18A 'read':9A,42B 'see':47B 'sharepoint':2A,19A,23B,27B,67C 'sourc':52B 'user':8A 'vendor':24B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["microsoftofficesharepoint","officesharepoint"],"ptokens":["microsoft","office","sharepoint"],"labels":["medium","microsoftoffice","sharepoint","vendor"],"campaign_type":null,"search_a":"'-109455':13A,16A '-2026':12A,15A 'author':4A,7A 'cve':11A,14A 'data':10A 'incorrect':3A 'let':5A 'microsoft':1A,17A 'office':18A 'read':9A 'sharepoint':2A,19A 'user':8A","search_b":"'account':41B 'alreadi':38B 'attack':36B 'author':31B 'check':32B 'data':59B 'detail':56B 'expos':61B 'give':53B 'incorrect':30B 'inform':43B 'let':34B 'microsoft':21B,25B 'microsoft-offic':20B 'network':50B 'offic':22B,26B 'read':42B 'see':47B 'sharepoint':23B,27B 'sourc':52B 'vendor':24B","search_c":"'allow':68C 'attack':71C 'author':63C,70C 'disclos':73C 'incorrect':62C 'inform':74C 'microsoft':65C 'network':77C 'offic':66C 'sharepoint':67C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109455","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109455","severity":null,"published_at":"2026-11-10T19:18:14+00:00","modified_at":"2026-11-10T19:18:14+00:00","first_seen_at":"2026-11-10T19:24:23+00:00","fetched_at":"2026-11-10T19:24:23+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}