{"id":"CVE-2026-110057","kind":"vulnerability","aliases":["CVE-2026-110057"],"related":[],"title":"Microsoft SharePoint: authorization bypass lets a signed-in user read data","description":"Authorization bypass through user-controlled key in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.","summary":"A flaw in Microsoft Office SharePoint lets an authorized user bypass access checks through a user-controlled key. An attacker on the network can disclose information the account should not see.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Microsoft Office SharePoint","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["microsoft-office","other","sharepoint"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:18:23+00:00","first_seen_at":"2026-11-10T19:24:27+00:00","triaged_at":"2026-11-10T19:58:05+00:00","updated_at":"2026-11-10T19:58:05+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-10T19:58:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft SharePoint: authorization bypass lets a signed-in user read data","impact":"low","summary":"A flaw in Microsoft Office SharePoint lets an authorized user bypass access checks through a user-controlled key. An attacker on the network can disclose information the account should not see.","audience":"businesses","category":"other","nicknames":[],"who_cares":["sharepoint","microsoft-office"],"confidence":0.4,"fix_status":"unknown","needs_auth":"yes","worst_case":"authorized user reads information beyond their permissions over the network","analyst_note":"Check the Microsoft Security Response Center entry for CVE-2026-110057 for affected versions, patch and any setting to change.","how_to_check":"unknown","plain_action":"","product_name":"Microsoft Office SharePoint","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000639,"input_tokens":4499,"output_tokens":378,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110057':15A,18A '-2026':14A,17A 'access':38B 'account':55B 'allow':70C 'attack':47B,73C 'author':3A,35B,59C,72C 'bypass':4A,37B,60C 'check':39B 'control':44B,64C 'cve':13A,16A 'data':12A 'disclos':52B,75C 'flaw':28B 'inform':53B,76C 'key':45B,65C 'let':5A,33B 'microsoft':1A,19A,23B,30B,67C 'microsoft-offic':22B 'network':50B,79C 'offic':24B,31B,68C 'office':20A 'read':11A 'see':58B 'sharepoint':2A,21A,26B,32B,69C 'sign':8A 'signed-in':7A 'user':10A,36B,43B,63C 'user-control':42B,62C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["microsoftofficesharepoint","officesharepoint"],"ptokens":["microsoft","office","sharepoint"],"labels":["medium","microsoftoffice","other","sharepoint","vendor"],"campaign_type":null,"search_a":"'-110057':15A,18A '-2026':14A,17A 'author':3A 'bypass':4A 'cve':13A,16A 'data':12A 'let':5A 'microsoft':1A,19A 'office':20A 'read':11A 'sharepoint':2A,21A 'sign':8A 'signed-in':7A 'user':10A","search_b":"'access':38B 'account':55B 'attack':47B 'author':35B 'bypass':37B 'check':39B 'control':44B 'disclos':52B 'flaw':28B 'inform':53B 'key':45B 'let':33B 'microsoft':23B,30B 'microsoft-offic':22B 'network':50B 'offic':24B,31B 'see':58B 'sharepoint':26B,32B 'user':36B,43B 'user-control':42B","search_c":"'allow':70C 'attack':73C 'author':59C,72C 'bypass':60C 'control':64C 'disclos':75C 'inform':76C 'key':65C 'microsoft':67C 'network':79C 'offic':68C 'sharepoint':69C 'user':63C 'user-control':62C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110057","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110057","severity":null,"published_at":"2026-11-10T19:18:23+00:00","modified_at":"2026-11-10T19:18:23+00:00","first_seen_at":"2026-11-10T19:24:27+00:00","fetched_at":"2026-11-10T19:24:27+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}