This vulnerability, identified as CWE-284 (Improper Access Control), exists in Microsoft 365 Copilot for iOS version 1.0. It allows an unauthorized attacker to elevate privileges remotely over a network. The CVSS 3.1 base score is 8.1, indicating high severity, with attack vector network, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality and integrity. The vulnerability is in a cloud service context, and Microsoft has released an official fix to address the issue.

An attacker who successfully exploits this vulnerability can elevate their privileges within Microsoft 365 Copilot for iOS, potentially gaining unauthorized access to sensitive data or functions. The impact includes high confidentiality and integrity loss, but no availability impact is noted. No known exploits are currently reported in the wild.

Microsoft has released an official fix for this vulnerability. As this is a cloud service, Microsoft manages remediation server-side. Users and administrators should ensure their Microsoft 365 Copilot for iOS service is updated according to Microsoft's guidance available at the official advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58617.