This vulnerability (CVE-2026-42823) in Microsoft Azure Logic Apps involves improper access control (CWE-284) that enables an authorized attacker to escalate privileges remotely. The CVSS 3.1 base score is 9.9, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and complete impact on confidentiality, integrity, and availability. The vulnerability affects the Azure Logic Apps cloud service. Microsoft has published an official fix and manages remediation server-side for this cloud-hosted service.

Successful exploitation allows an authorized attacker to elevate privileges within Azure Logic Apps, potentially leading to full compromise of affected resources and services. The impact includes complete loss of confidentiality, integrity, and availability of the affected service components.

Microsoft has released an official fix for this vulnerability and manages remediation for Azure Logic Apps as a cloud service. Users should ensure their Azure Logic Apps instances are updated according to Microsoft's guidance at the provided vendor advisory URL. No additional user action is required beyond applying the official fix.