CVE-2026-12591

{
  "etk_id": "ETK-2026-4251",
  "cve_id": "CVE-2026-12591",
  "display_id": "CVE-2026-12591",
  "ghsa_id": "GHSA-v53h-q7r3-wr4w",
  "euvd_id": "EUVD-2026-124322",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Improper authorization in M365 Manager Plus delegated administration",
  "summary": "M365 Manager Plus builds below 4818 have an authorization flaw in delegated administration. An authenticated technician could obtain privileges beyond their intended scope and may trigger code execution during administrative processing. Exploitation requires a technician account.",
  "mitigation": "Upgrade M365 Manager Plus to build 4818 or later. Review delegated technician accounts and remove unnecessary permissions until the update is complete.",
  "vendor": "Zohocorp",
  "product": "M365 Manager Plus",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 4818"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "4818"
      ],
      "package_name": "M365 Manager Plus",
      "purl": null
    }
  ],
  "cwes": [
    862
  ],
  "cvss_score": 9.9,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 21.716820133333332,
  "t0_at": "2026-11-12T06:55:31.695000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-12T06:55:31.695000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-12T06:55:31.695000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-12591"
    }
  }
}