CVE-2026-83711: CWE-639: Authorization Bypass Through User-Controlled Key in Microsoft Entra

This vulnerability (CVE-2026-83711) involves an authorization bypass through a user-controlled key in Microsoft Entra (Azure Active Directory B2C). An attacker can exploit this flaw remotely without privileges or user interaction to gain elevated privileges. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, with high confidentiality and integrity impacts. The vendor has released an official fix and manages remediation for this cloud-hosted service.

Successful exploitation allows an attacker to bypass authorization controls and elevate privileges remotely, potentially leading to full compromise of affected accounts or services. Confidentiality and integrity impacts are high, while availability is not affected. This could enable unauthorized access to sensitive resources within Microsoft Entra environments.

Microsoft has released an official fix for this vulnerability and manages remediation for this cloud-hosted service. Administrators should ensure their environments are updated according to Microsoft's guidance. No additional action is required beyond applying the official fix as provided by Microsoft.