---
id: "CVE-2026-114162"
page: "https://infrastack.ai/live/CVE-2026-114162"
kind: "vulnerability"
aliases: ["CVE-2026-114162"]
title: "Microsoft Graph: incorrect authorization lets an attacker gain higher privileges"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["azure", "cloud-service", "microsoft-365", "microsoft-graph", "vendor"]
not_affected_if: []
published_at: "2026-11-10T19:19:09+00:00"
first_seen_at: "2026-11-10T19:24:44+00:00"
updated_at: "2026-11-10T19:33:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114162", "first_seen_at": "2026-11-10T19:24:44+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-10T19:33:22+00:00"}]
exploit_sources: []
---

# Microsoft Graph: incorrect authorization lets an attacker gain higher privileges

Link for people: https://infrastack.ai/live/CVE-2026-114162 (this .md is for agents)

Microsoft Graph has an incorrect authorization flaw that lets an attacker who already holds high privileges elevate privileges over the network (CVSS 3.1 9.1, privileges required: high, scope changed). The NVD record, scored by Microsoft, is the only source read. It says nothing about exploitation, a fix or customer action.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

unknown: no Microsoft guidance read yet. Open the MSRC Security Update Guide entry for CVE-2026-114162 and look for the affected component and any customer action.

## Timeline

- 2026-11-10T19:24:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114162
- 2026-11-10T19:33:22+00:00 analyst — MSRC page is JS-only and web-cli returned nothing for MSRC, CVRF API and NVD; no primary text read. Only the NVD record (CVSS 3.1 9.1, AV:N/AC:L/PR:H/UI:N/S:C, scored by secure@microsoft.com) is known. Nothing verified. Revisit when the MSRC page can be read (try browser-cli) to confirm cloud-service status and any customer action.

## From the sources

Incorrect authorization in Microsoft Graph allows an authorized attacker to elevate privileges over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_