This vulnerability (CVE-2026-33823) in Microsoft Teams involves improper authorization (CWE-285), enabling an attacker with some level of authorization to disclose sensitive information over a network. The CVSS 3.1 base score is 9.6 (critical), with network attack vector, low attack complexity, privileges required, no user interaction, and scope changed. Confidentiality and integrity impacts are high, while availability is not affected. Microsoft has published an official fix for this vulnerability as indicated by the remediation level and vendor advisory.

An attacker with authorized access can exploit this vulnerability to disclose sensitive information over the network, potentially compromising confidentiality and integrity of data within Microsoft Teams. There is no impact on availability. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the patch provided in the Microsoft security update referenced in the vendor advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33823) to remediate this vulnerability.