The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have that permission.

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-82986 · Microsoft / collected KEV context

cve-program · CVE-2026-82986

• https://hackerone.com/reports/3642236

• The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have that permission. · Newly collected advisory · 27 Oct 2026