The Microsoft Container Migration Solution Accelerator, a multi-service AI-driven application for migrating container configurations to Azure Kubernetes Service, contains an authorization bypass vulnerability (CWE-639) in version 2.1.2 and earlier. Authenticated users can exploit missing ownership checks in multiple API endpoints to access, modify, or delete migration processes and files belonging to other users in the same organization. The application relies on Entra ID for authentication but does not enforce proper authorization controls, leading to an insecure direct object reference condition. This vulnerability affects both process and file management APIs and is present in the cloud service environment.

Exploitation of this vulnerability allows authenticated users to access and manipulate migration data of other users within the same organization without proper authorization. This can lead to unauthorized disclosure, modification, or deletion of sensitive migration processes and files, potentially disrupting migration workflows and compromising data integrity. The vulnerability has a CVSS 4.0 score of 8.7, indicating high severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

A patch is available for this vulnerability. Since the product is a cloud-hosted service, Microsoft manages remediation server-side. Users and administrators should verify that the service is updated to the patched version as per Microsoft's advisory. Until the patch is applied, users should be aware of the risk of unauthorized access within their organization. Check the official Microsoft advisory for detailed remediation instructions and confirmation of patch deployment.