CVE-2026-15630
CriticalCVSS 9.9Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between authorization (based on ?id=) and action (based on request body).
Risk Assessment
Breach of tenant isolation can lead to unauthorized access to data and resources of other organizations, posing a serious risk to data confidentiality and integrity.
Recommendation
Contact the software vendor for a patch or apply a workaround by strengthening permission validation.
Original NVD description (English source)
A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between authorization (based on ?id=) and action (based on request body).