The vulnerability in Microsoft Azure API Management allows an attacker to reuse the self-service signup registration flow from one tenant to another by modifying the hostname or tenant identifier. Although Tenant B has signup disabled at the UI level, the API endpoint still processes signup requests if the Host header is changed. The vendor evaluated this behavior and concluded it is a configuration or state management issue rather than a product vulnerability that breaks tenant isolation or security boundaries.

The impact is limited to a configuration/state issue where signup disabling at the UI level does not prevent signup via the API endpoint when the Host header is manipulated. There is no breach of tenant isolation or security boundary according to the vendor. No known exploits are reported in the wild.

As this is a cloud service, the vendor manages remediation. A patch is available according to the input data. Users should verify with the vendor advisory for current remediation status and apply any official fixes or updates provided by Microsoft Azure API Management to address this issue.