Incorrect authorization in Microsoft SharePoint Server - CVE-2026-109455
Published: November 10, 2026
Vulnerability identifier: #VU164728
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-109455
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information indexed from SharePoint content outside the sites they are authorized to read.
The vulnerability exists due to incorrect authorization in Microsoft SharePoint Server search functionality when handling requests for indexed content. A remote user can query the affected search index to retrieve information from sites they are not authorized to read.
The disclosure does not provide unrestricted access to every file on the server.
Affected software
Microsoft SharePoint Server
How to mitigate CVE-2026-109455
Install security update from vendor's website.
Microsoft SharePoint Server - update to 16.0.20326.20278