CVE-2026-65667

The 'missing authorization' label in this CVE is more informative than the CVSS 10 score. It tells you this is not a token forgery or cryptographic failure, but most likely a missing scope check or incorrect principal assignment in a specific code path—the authorization contract was never written for that boundary, or was dropped during a feature extension. The CVSS 10 score conflicts with Teams' tenant-isolated architecture. Achieving a 10 requires Privileges Required:NONE and Attack Complexity:LOW, meaning any remote attacker can escalate to any Teams account. But Teams authentication is tenant-bound and enforces token validation through OIDC/Azure AD layers. If this truly bypasses tenant authorization without any prior foothold, it would need to circumvent that entire validation chain—which suggests the realistic exploitation threshold is likely 8.0-9.0, not 10. The 'over a network' qualifier in the CVE is technically correct under CVSS rules (it covers both open internet and privileged corporate network positions), but it obscures the actual precondition: you probably need a privileged network position or existing session context, not arbitrary internet access. Where to look for the problem: tenant-isolated collaboration products accumulate forgotten code like sediment—legacy notification endpoints, sunsetted cross-tenant features, migration shims that survived architectural refactors because removing them seemed riskier than leaving them running. These abandoned paths don't inherit the authorization improvements made to active code. The fix will show you exactly which endpoint and token type was missing enforcement; that's the ground truth you need. Priority: patch immediately. Then audit your Teams environment for similar legacy endpoints and API paths that may have escaped security hardening. The CVSS number tells you the ceiling; it tells you nothing about how long the floor has been missing.

Reviewed through automated stages and approved by a human before publication.