CVE-2026-94510: CWE-639: Authorization Bypass Through User-Controlled Key in Microsoft Microsoft Bookings

This vulnerability (CVE-2026-94510) in Microsoft Bookings is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). It allows an unauthorized attacker to bypass authorization controls by exploiting a user-controlled key, resulting in privilege escalation over a network. The CVSS 3.1 base score is 9.9, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and significant impact on confidentiality, integrity, and availability. Microsoft has published an official fix for this vulnerability.

Exploitation of this vulnerability can lead to unauthorized privilege escalation, compromising the confidentiality, integrity, and availability of the affected system. Given the critical CVSS score, the impact is severe, potentially allowing attackers to gain elevated access and perform unauthorized actions within Microsoft Bookings.

An official fix is available from Microsoft. Users and administrators should apply the patch provided by Microsoft as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-94510 to remediate this vulnerability.