CVE-2026-69558: CWE-639: Authorization Bypass Through User-Controlled Key in Microsoft Microsoft Partner Center

This vulnerability (CVE-2026-69558) in Microsoft Partner Center is categorized as CWE-639 (Authorization Bypass Through User-Controlled Key). It allows an unauthorized attacker to bypass authorization controls by manipulating a user-controlled key, resulting in unauthorized disclosure of information over a network. The vulnerability has a high CVSS 3.1 base score of 8.6, indicating network attack vector, low attack complexity, no privileges or user interaction required, and a scope change with high confidentiality impact but no integrity or availability impact. Microsoft has released an official fix for this vulnerability.

An unauthorized attacker can exploit this vulnerability to bypass authorization mechanisms and disclose sensitive information over the network. The impact is limited to confidentiality loss without affecting integrity or availability. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators of Microsoft Partner Center should apply the provided patch as soon as possible to remediate this vulnerability. Refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69558 for detailed update instructions.