{"@odata.context":"https://api.msrc.microsoft.com/sug/v2.0/sugodata/v2.0/en-US/$metadata#vulnerability/$entity","id":"00000000-0000-0000-0000-000031787598","releaseDate":"2026-10-15T07:00:00-07:00","cveNumber":"CVE-2026-80092","cveTitle":"Microsoft Identity Web Elevation of Privilege Vulnerability","releaseNumber":"2026-Oct","vulnType":"Security Vulnerability","latestRevisionDate":"2026-10-19T07:00:00-07:00","description":"<p>Authentication bypass by assumed-immutable data in Microsoft Identity Web allows an authorized attacker to elevate privileges over a network.</p>\n","cweList":["CWE-302: Authentication Bypass by Assumed-Immutable Data"],"cweDetailsListForSearch":["cwe: CWE-302: Authentication Bypass by Assumed-Immutable Data","cweUrl: https://cwe.mitre.org/data/definitions/302.html"],"unformattedDescription":"<p>Authentication bypass by assumed-immutable data in Microsoft Identity Web allows an authorized attacker to elevate privileges over a network.</p>","mitreText":"CVE-2026-80092","mitreUrl":"https://www.cve.org/CVERecord?id=CVE-2026-80092","publiclyDisclosed":"No","exploited":"No","latestSoftwareReleaseId":2,"latestSoftwareRelease":"Exploitation Less Likely","olderSoftwareReleaseId":0,"denialOfService":"N/A","tag":"Microsoft Identity Web","issuingCna":"Microsoft","issuingCnaId":100000001,"severityId":100000001,"severity":"Important","impactId":100000002,"impact":"Elevation of Privilege","langCode":"en-US","baseScore":"5.3","temporalScore":"4.6","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C","vectorStringSource":"Microsoft","isMariner":false,"customerActionRequired":true,"customerActionRequiredId":1,"cweDetailsList":[{"keys":["cwe","cweUrl"],"values":["CWE-302: Authentication Bypass by Assumed-Immutable Data","https://cwe.mitre.org/data/definitions/302.html"]}],"articles":[{"articleType":"FAQ","description":"<p><strong>What privileges could an attacker gain by exploiting this vulnerability?</strong></p>\n<p>An attacker could obtain another user's access token and access resources permitted by that token. The accessible resources depend on the permissions granted to the affected user's token.</p>\n","ordinal":10000},{"articleType":"FAQ","description":"<p><strong>What conditions are required to exploit this vulnerability?</strong></p>\n<p>Successful exploitation requires the application to use a shared token cache and the targeted user to have an active token in that cache.</p>\n","ordinal":10000},{"title":"Microsoft Identity Web Elevation of Privilege Vulnerability","articleType":"100000000","description":"<p>Authentication bypass by assumed-immutable data in Microsoft Identity Web allows an authorized attacker to elevate privileges over a network.</p>\n","ordinal":10000}],"revisions":[{"cveNumber":"CVE-2026-80092","version":1,"revisionDate":"2026-10-15T07:00:00-07:00","initialDate":"0001-01-01T00:00:00Z","description":"<p>Information published.</p>\n","unformattedDescription":"Information published.","notificationNeeded":false,"notificationSent":false,"sourceId":"504a712f-f7c7-f111-aaae-6045bd00cd58"},{"cveNumber":"CVE-2026-80092","version":1.1,"revisionDate":"2026-10-19T07:00:00-07:00","initialDate":"0001-01-01T00:00:00Z","description":"<p>Updated the Security Updates table to list Microsoft Identity Web v3 and v4 separately and clarify the affected version ranges. The existing security updates are versions 3.16.0 and 4.16.1, respectively. This is an informational change only.</p>\n","unformattedDescription":"Updated the Security Updates table to list Microsoft Identity Web v3 and v4 separately and clarify the affected version ranges. The existing security updates are versions 3.16.0 and 4.16.1, respectively. This is an informational change only.","notificationNeeded":false,"notificationSent":false,"sourceId":"65daccec-f1cb-f111-a059-70a8a5b1fb82"}]}