CVE-2026-40375

CVE-2026-40375 is a missing authorization vulnerability in Microsoft Dynamics 365 Business Central where an authenticated user can access data outside their permitted scope through the platform's extension layer. The CVSS 6.5 score badly understates the risk for organizations where Business Central serves as the system of record — information disclosure here means exposed pricing structures, vendor terms, unreleased financial results, and customer data that competitors or malicious insiders would actively target. The critical insight often missed is that Business Central isn't a monolithic application where Microsoft controls all code paths — it's a platform where partners and developers extend functionality through AL extensions, page customizations, web service endpoints, and role definitions. When a developer adds a page or query to expose business data, the mental model defaults to "authenticated user can access this" rather than "which authenticated users should access this under which conditions." The vulnerability isn't missing code; it's an absence of enforcement scaffolding at the platform boundary. What you should do: First, inventory every AL extension, page extension, and web service endpoint currently deployed — each represents an authorization decision made by someone who may no longer be involved. Second, audit the data integration points connecting Business Central to CRM, production planning, financial reporting, and vendor management systems — an authorization failure here cascades into every downstream system that consumes BC data as authoritative. Third, examine your role definitions and permission sets for implicit assumptions about horizontal isolation that may never have been explicitly tested. Fourth, recognize that the remediation timeline in Business Central is not just the patch cycle — it's the organizational archaeology required to verify that extensions written five years ago by departed consultants will remain compatible when Microsoft hardens the authorization boundary. The historical pattern across extensible enterprise platforms (SAP modification exits, SharePoint farm solutions, Apex sharing rules) suggests Microsoft will eventually constrain this extension model — the question is whether they do it through platform-level enforcement or through partner ecosystem disruption. Either way, treating this as a discrete patch rather than a structural condition in your extension inventory risks missing the next instance of the same class within the same product cycle.

Reviewed through automated stages and approved by a human before publication.