{"id":"CVE-2026-109466","kind":"vulnerability","aliases":["CVE-2026-109466"],"related":[],"title":"Microsoft SharePoint: missing authorization lets a signed-in user gain privileges","description":"Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over an adjacent network.","summary":"Microsoft Office SharePoint does not check authorization properly, so an attacker with a valid account on the network can raise their privileges. NVD rates it high (CVSS 8.0).","severity":"high","cvss":8.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["microsoft-office","runtime","sharepoint","windows"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:18:15+00:00","first_seen_at":"2026-11-10T19:24:24+00:00","triaged_at":"2026-11-10T19:36:14+00:00","updated_at":"2026-11-10T19:36:14+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-10T19:36:14Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"Microsoft SharePoint: missing authorization lets a signed-in user gain privileges","impact":"high","summary":"Microsoft Office SharePoint does not check authorization properly, so an attacker with a valid account on the network can raise their privileges. NVD rates it high (CVSS 8.0).","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["sharepoint","microsoft-office","windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated attacker gains higher privileges within SharePoint","analyst_note":"Check the Microsoft Security Response Center advisory for affected SharePoint versions, fixed builds and any required configuration.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organisations running Microsoft SharePoint on-premises where users have accounts on the network. The sources do not list affected versions or configurations, so unknown.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000652,"input_tokens":4496,"output_tokens":405,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Check the Microsoft Security Response Center advisory for affected SharePoint versions, fixed builds and any required configuration.","search":"'-109466':15A,18A '-2026':14A,17A '8.0':52B 'account':39B 'adjac':68C 'allow':59C 'attack':35B,62C 'author':4A,31B,54C,61C 'check':30B 'cve':13A,16A 'cvss':51B 'elev':64C 'gain':11A 'high':50B 'let':5A 'microsoft':1A,20B,25B,56C 'microsoft-offic':19B 'miss':3A,53C 'network':42B,69C 'nvd':47B 'offic':21B,26B,57C 'privileg':12A,46B,65C 'proper':32B 'rais':44B 'rate':48B 'runtim':22B 'sharepoint':2A,23B,27B,58C 'sign':8A 'signed-in':7A 'user':10A 'valid':38B 'window':24B","nicknames":[],"mitigations":[],"who_affected":"Organisations running Microsoft SharePoint on-premises where users have accounts on the network. The sources do not list affected versions or configurations, so unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","microsoftoffice","runtime","sharepoint","windows"],"campaign_type":null,"search_a":"'-109466':15A,18A '-2026':14A,17A 'author':4A 'cve':13A,16A 'gain':11A 'let':5A 'microsoft':1A 'miss':3A 'privileg':12A 'sharepoint':2A 'sign':8A 'signed-in':7A 'user':10A","search_b":"'8.0':52B 'account':39B 'attack':35B 'author':31B 'check':30B 'cvss':51B 'high':50B 'microsoft':20B,25B 'microsoft-offic':19B 'network':42B 'nvd':47B 'offic':21B,26B 'privileg':46B 'proper':32B 'rais':44B 'rate':48B 'runtim':22B 'sharepoint':23B,27B 'valid':38B 'window':24B","search_c":"'adjac':68C 'allow':59C 'attack':62C 'author':54C,61C 'elev':64C 'microsoft':56C 'miss':53C 'network':69C 'offic':57C 'privileg':65C 'sharepoint':58C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109466","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109466","severity":null,"published_at":"2026-11-10T19:18:15+00:00","modified_at":"2026-11-10T19:18:15+00:00","first_seen_at":"2026-11-10T19:24:24+00:00","fetched_at":"2026-11-10T19:24:24+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}