CVE-2025-29826: Microsoft Dataverse

High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days.

Improper handling of insufficient permissions or privileges in Microsoft Dataverse allows an authorized attacker to elevate privileges over a network.

Affected products

• Microsoft Dataverse: before 3.4.0.1406 (fixed in 3.4.0.1406)

Published 2025-05-13. Last modified 2026-06-17.