CVE-2026-33823 is an improper authorization vulnerability (CWE-285) in Microsoft Teams that enables an attacker with some level of authorization to disclose sensitive information over a network. The vulnerability has a CVSS 3.1 base score of 9.6, reflecting critical severity with network attack vector, low attack complexity, and no user interaction required. The impact includes high confidentiality and integrity loss but no availability impact. Microsoft has published an official fix to address this vulnerability.

An attacker with authorized access to Microsoft Teams can exploit this vulnerability to disclose sensitive information over the network, resulting in a high impact on confidentiality and integrity of data. There is no reported impact on availability. No known exploits are currently active in the wild.

Microsoft has released an official fix for CVE-2026-33823. Users and administrators of Microsoft Teams should apply the patch as soon as possible to remediate this vulnerability. Since this is not a cloud service, remediation depends on applying the update to affected installations. Refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33823 for detailed patching instructions.