This vulnerability, identified as CWE-287 (Improper Authentication), exists in Microsoft Azure Spring Apps version 1.0.0. It allows an attacker with some level of authorization to escalate their privileges remotely over the network. The CVSS 3.1 base score is 8.2, indicating high severity, with network attack vector, high complexity, low privileges required, no user interaction, and impacts on confidentiality and integrity. The vulnerability is confirmed as patched by Microsoft with an official fix. Since Azure Spring Apps is a cloud service, Microsoft manages the remediation on their side.

An attacker who is already authorized can exploit this vulnerability to elevate their privileges, potentially gaining higher access rights than intended. This can lead to compromise of confidentiality and integrity of the affected service. Availability is not impacted. No known exploits are reported in the wild at this time.

Microsoft has released an official fix for this vulnerability and manages remediation for Azure Spring Apps as a cloud service. Users should ensure their Azure Spring Apps instances are updated according to Microsoft's guidance in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50338. No additional action is required beyond applying the official fix.