CVE-2026-69558

This is an authorization bypass in Microsoft Partner Center where the application improperly trusts a client-supplied identifier—likely a GUID-based resource identifier or API key—rather than validating tenant ownership server-side. The 'user-controlled key' phrasing is the analytical signal: the vulnerability is an Insecure Direct Object Reference pattern, not a broken crypto primitive or injection flaw. This means an attacker with Partner Center access could potentially enumerate or manipulate resource identifiers to access another partner's data—customer records, billing information, subscription details—without proper cross-tenant authorization checks. The CVSS 8.6 is high because exploitation requires network access and no valid authentication beyond having an account in the system. If the resource identifiers are predictable or can be extracted from your own API responses and substituted, exploitability is trivial: any partner with basic API familiarity could script enumeration of other partners' data. Your priority actions: First, audit your Partner Center API usage to identify every endpoint that accepts object references (customer IDs, subscription GUIDs, billing record IDs). For each, verify the authorization layer explicitly checks that the requested resource belongs to the authenticated tenant. Second, check Microsoft's audit logs for any anomalous API activity—unusual enumeration patterns, bulk exports, or access to resource IDs outside your typical scope. Third, if you manage multiple CSP tenants, review which API keys or service principals have cross-tenant delegation permissions and whether those permissions were intentionally granted. The regulatory dimension matters: Partner Center handles GDPR-regulated data across organizational boundaries. If this flaw enabled cross-tenant access before patching, Microsoft's disclosure obligations under Article 33 may determine whether you received notification. Regardless, document what your API activity looked like during the vulnerable window in case of future regulatory inquiry.

Reviewed through automated stages and approved by a human before publication.