CVE-2026-73298

Name of the Vulnerable Software and Affected Versions Microsoft Container Migration Solution Accelerator versions prior to 2.1.3

Description An authenticated Insecure Direct Object Reference (IDOR)—a flaw where an application provides direct access to objects based on user-supplied input—exists in the process and file management APIs. Due to missing ownership checks, authenticated users can read, write, and delete processes and files belonging to other authenticated users within the same organization. While the application uses Entra ID for authentication, it lacks the necessary authorization controls to prevent unauthorized access and modification of migration data across different users.

Recommendations Update to a version newer than 2.1.2. Restrict access to the process and file management APIs to minimize the risk of unauthorized data modification until the update is applied.