Microsoft SharePoint Connector Flaw Could’ve Enabled Credential Theft Across Power Platform

Summary: A recently patched vulnerability in the Microsoft SharePoint connector within the Power Platform could allow attackers to harvest user credentials and gain unauthorized access to sensitive data. The flaw, identified as server-side request forgery (SSRF), requires an attacker to have specific user roles within Power Platform and enables follow-on attacks across interconnected services. The vulnerability attracted attention due to its significant implications for security within corporate environments that utilize SharePoint.

Affected: Microsoft Power Platform

Keypoints :

• Disclosed vulnerability permits credential harvesting if exploited successfully.
• Attackers need Environment Maker and Basic User roles to execute malicious actions.
• Exploitation could extend risks across services like Power Apps and Copilot Studio.