CVE-2026-12591

{
  "etk_id": "ETK-2026-4251",
  "cve_id": "CVE-2026-12591",
  "display_id": "CVE-2026-12591",
  "ghsa_id": null,
  "euvd_id": null,
  "status": "in_pipeline",
  "anchor_state": "anchored",
  "title": "Permission validation flaw in M365 Manager Plus",
  "summary": "M365 Manager Plus versions earlier than 4818 have insufficient permission validation in delegated administration. An authenticated technician may gain privileges beyond their intended scope and could potentially trigger remote code execution during administrative processing.",
  "mitigation": "Upgrade M365 Manager Plus to version 4818 or later. Until upgraded, restrict delegated-administration access to trusted technician accounts and review assigned permissions.",
  "vendor": "Zohocorp",
  "product": "M365 Manager Plus",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 4818"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "4818"
      ],
      "package_name": "M365 Manager Plus",
      "purl": null
    }
  ],
  "cwes": [
    862
  ],
  "cvss_score": 9.9,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": null,
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": null,
  "t0_at": "2026-11-12T06:55:31.695000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-12T06:55:31.695000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-12T06:55:31.695000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12591"
    }
  }
}