This vulnerability in Microsoft Graph involves the exposure of sensitive information to unauthorized actors by an authorized attacker over a network. It is identified as CWE-200, which pertains to the exposure of sensitive information. The CVSS 3.1 vector indicates the attack requires network access, low attack complexity, and privileges, with no user interaction needed. The confidentiality impact is high, while integrity and availability are not affected. Microsoft has published an official fix for this vulnerability.

An authorized attacker can disclose sensitive information over a network, potentially leading to unauthorized data exposure. The confidentiality impact is high, but there is no impact on integrity or availability. This could result in sensitive data leakage if exploited.

An official fix is available from Microsoft. Users and administrators should apply the provided patch as soon as possible to remediate this vulnerability. Refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49159 for detailed patching instructions.