CVE-2026-58639

The CVSS 6.5 score assigned to this SharePoint SSRF obscures a more serious risk: authorized users gain server-perspective network positioning that breaks out of the application's access control model entirely. SharePoint is not a typical web application. It sits as an integration hub with trusted connections to SQL Server databases, domain controllers, file servers, and identity providers. These trust relationships exist at the server level, not the user level. When an authenticated user exploits this SSRF, they're not limited to what their account can access through the UI — they're making requests as SharePoint Server itself, inheriting every backend trust relationship the farm maintains. The NVD description's use of 'spoofing over a network' is atypical for SSRF entries and likely signals a composite vulnerability. This phrasing typically appears when SSRF serves as a relay mechanism for authentication impersonation rather than mere internal reconnaissance. If the attack enables SharePoint to be tricked into making requests that backend systems treat as legitimate farm authentication, you're looking at credential relay — not port scanning. That's a fundamentally different risk profile that collapses multiple attack hops into one. The 'authorized attacker' constraint that justifies the 6.5 rating is also practically weaker than it appears. SharePoint collaboration requires broad permissions — the authentication gate is technically true but organizationally thin. Partner accounts, contractor access, and evolving M365 integrations all expand who counts as authorized over time. Key actions: First, verify whether your SharePoint farm has outbound trust relationships to sensitive backends (especially SQL, domain controllers, and internal APIs) and treat this as a pivot vector accordingly. Second, examine the 'spoofing' component — if this enables authentication relay to backend systems, the priority escalates beyond what the CVSS suggests. Third, audit service accounts used for SharePoint's outbound connections; many deployments run with credentials that haven't been rotated since initial setup, and deprecated code paths may exist that those credentials still access. Finally, treat any unpatched window as accumulating risk — each week after disclosure, more automation and integration points assume SharePoint's outbound requests are legitimate.

Reviewed through automated stages and approved by a human before publication.