This vulnerability (CVE-2026-41100) involves improper access control in Microsoft 365 Copilot for Android, categorized under CWE-284. It enables an authorized attacker with local access to perform spoofing attacks. The CVSS 3.1 vector indicates low attack complexity and privileges required, no user interaction, and limited confidentiality and integrity impact without availability impact. The vulnerability affects version 1.0 of the product. Microsoft has issued an official fix and manages remediation as this is a cloud service.

An authorized local attacker can exploit this vulnerability to spoof identities or actions within Microsoft 365 Copilot for Android, potentially leading to limited confidentiality and integrity impacts. There is no impact on availability. No known exploits are reported in the wild.

An official fix is available from Microsoft. Since Microsoft 365 Copilot for Android is a cloud service, Microsoft manages the remediation server-side. Users and administrators should ensure their environments are updated according to Microsoft's guidance available at the official advisory URL.