CVE-2025-62931 describes a Missing Authorization vulnerability in the microsoftstart MSN Partner Hub product (versions up to 2.9). The issue stems from incorrectly configured access control, which may allow users with limited privileges to access resources or perform actions without proper authorization. The CVSS 3.1 vector indicates the vulnerability is remotely exploitable over the network with low attack complexity and requires privileges but no user interaction. The impact is limited to partial confidentiality loss without affecting integrity or availability. No vendor patch or advisory is currently available, and no known exploits have been reported.

The vulnerability could allow an attacker with some level of privileges to bypass authorization controls and access data that should be restricted, leading to limited confidentiality impact. There is no impact on data integrity or system availability. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review and tighten access control configurations in the MSN Partner Hub environment to ensure proper authorization enforcement. Monitor for any updates from the vendor regarding patches or mitigations.