An authorized attacker can bypass security features in Microsoft Power Apps due to improper neutralization of control sequences.

The application improperly neutralizes escape, meta, or control sequences, allowing an authenticated (authorized) attacker to bypass security controls over the network.

By bypassing security features, an attacker can perform unauthorized actions within the Power Apps environment that they would otherwise be restricted from executing. This could lead to unauthorized data access, modification of business logic, or escalation of privileges within the application. The CVSS score of 9.0 highlights the potential for significant disruption to business processes and security policy enforcement.

Immediate Action: Update the Microsoft Power Apps Desktop Client to version 3.26032.10.0 or later as advised by Microsoft.

Proactive Monitoring: Review application access logs for irregular activity or unauthorized attempts to perform administrative functions within Power Apps.

Compensating Controls: Enforce strict access control lists (ACLs) and Principle of Least Privilege (PoLP) for all users interacting with the Power Apps environment to minimize the impact of a potential security bypass.

Public Exploit Available: Unknown

Although this vulnerability requires the attacker to be authorized, the high severity score indicates that it poses a significant risk to the security posture of the platform. Security teams should deploy the provided update across all affected desktop client installations to ensure security controls are correctly enforced.