Assessment
Authorization bypass through user-controlled key in Azure DevOps Server allows an authorized attacker to elevate privileges over a network.
- Severity
- Important
- CVSS base score
- 8.8
- Impact
- Elevation of Privilege
- Exploitation detected
- No known exploitation (MSRC assessment)
- Exploitability
- Not assessed
- Publicly disclosed
- No (MSRC assessment)
- EPSS · 30-day forecast
- No EPSS score collected
- Customer action
- Required: follow the MSRC remediation guidance
More details
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
- Public detection template
- No Nuclei template is listed in the current collected catalog
- Component
- Azure DevOps Server
- Weakness
- CWE-639: Authorization Bypass Through User-Controlled Key
- Issued by
- Microsoft
- Last revised
- 10 Nov 2026
CVSS 3.1 base metricsRed raises the risk · green lowers it
- Attack vector
- NetworkAV:N
- Attack complexity
- LowAC:L
- Privileges required
- LowPR:L
- User interaction
- NoneUI:N
- Scope
- UnchangedS:U
- Confidentiality
- HighC:H
- Integrity
- HighI:H
- Availability
- HighA:H
Updates that fix it
0 KBsNo KB listed
No KB update is listed in the collected MSRC record. Check the MSRC advisory for product releases and other remedies.
Affected products
Developer Tools
Page history
Changes are dated when recorded; day views use the last saved version from that UTC day, and citations stay fixed.
Cite this versionField-level log (0)
Up to 100 recent field edits are shown; older edits may be outside retention.
No retained field changes for this selection.