{"id":"CVE-2026-112974","kind":"vulnerability","aliases":["CVE-2026-112974"],"related":[],"title":"Microsoft Account: improper access control lets a local user tamper","description":"Improper access control in Microsoft Account allows an authorized attacker to perform tampering locally.","summary":"Microsoft Account has an improper access control flaw that lets an authorized attacker tamper with data on the machine. The sources give no further detail on what data or which versions are affected.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Microsoft Account","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["microsoft-account","other"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:18:48+00:00","first_seen_at":"2026-11-10T19:24:36+00:00","triaged_at":"2026-11-10T20:02:06+00:00","updated_at":"2026-11-10T20:02:06+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-10T20:02:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Microsoft Account: improper access control lets a local user tamper","impact":"medium","summary":"Microsoft Account has an improper access control flaw that lets an authorized attacker tamper with data on the machine. The sources give no further detail on what data or which versions are affected.","audience":"everyone","category":"other","nicknames":[],"who_cares":["microsoft-account"],"confidence":0.4,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user with access tampers with protected account data","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-112974 for affected products, versions and fix status.","how_to_check":"unknown","plain_action":"","product_name":"Microsoft Account","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000625,"input_tokens":4477,"output_tokens":354,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112974':13A,16A '-2026':12A,15A 'access':4A,27B,56C 'account':2A,18A,21B,23B,60C 'affect':54B 'allow':61C 'attack':34B,64C 'author':33B,63C 'control':5A,28B,57C 'cve':11A,14A 'data':37B,49B 'detail':46B 'flaw':29B 'give':43B 'improp':3A,26B,55C 'let':6A,31B 'local':8A,68C 'machin':40B 'microsoft':1A,17A,20B,22B,59C 'microsoft-account':19B 'perform':66C 'sourc':42B 'tamper':10A,35B,67C 'user':9A 'version':52B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"pkeys":["account","microsoftaccount"],"ptokens":["account","microsoft"],"labels":["medium","microsoftaccount","other","vendor"],"campaign_type":null,"search_a":"'-112974':13A,16A '-2026':12A,15A 'access':4A 'account':2A,18A 'control':5A 'cve':11A,14A 'improp':3A 'let':6A 'local':8A 'microsoft':1A,17A 'tamper':10A 'user':9A","search_b":"'access':27B 'account':21B,23B 'affect':54B 'attack':34B 'author':33B 'control':28B 'data':37B,49B 'detail':46B 'flaw':29B 'give':43B 'improp':26B 'let':31B 'machin':40B 'microsoft':20B,22B 'microsoft-account':19B 'sourc':42B 'tamper':35B 'version':52B","search_c":"'access':56C 'account':60C 'allow':61C 'attack':64C 'author':63C 'control':57C 'improp':55C 'local':68C 'microsoft':59C 'perform':66C 'tamper':67C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112974","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112974","severity":null,"published_at":"2026-11-10T19:18:48+00:00","modified_at":"2026-11-10T19:18:48+00:00","first_seen_at":"2026-11-10T19:24:36+00:00","fetched_at":"2026-11-10T19:24:36+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}