This vulnerability (CVE-2026-26149) in Microsoft Power Apps arises from improper neutralization of escape, meta, or control sequences (CWE-150). It enables an attacker with authorized access to bypass security controls remotely, resulting in a critical impact on confidentiality, integrity, and availability. The CVSS v3.1 base score is 9.0, reflecting network attack vector, low attack complexity, required privileges, user interaction, and scope change with high impact on all security properties. Microsoft has released a temporary fix to address the issue, as detailed in their advisory.

Successful exploitation allows an authorized attacker to bypass security features remotely, leading to complete compromise of confidentiality, integrity, and availability of the affected Microsoft Power Apps instance. This could result in unauthorized data access, modification, or denial of service.

Microsoft has provided a temporary fix for this vulnerability. It is recommended to apply the temporary fix as described in the official Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26149. Monitor the vendor advisory for updates regarding a permanent official fix.