Microsoft Power Automate Desktop Information Disclosure Vulnerability
CVE-2025-29817 is an information disclosure vulnerability in Power Automate (rated Important, CVSS 5.7).
1 version
Facts
- Microsoft id
CVE-2025-29817- Products
- Power Automate
- Severity
- Important
- Impact
- Information Disclosure
- CVSS
- 5.7
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
- Exploited
- No
- Publicly disclosed
- No
- Exploitability
- Exploitation Less Likely
- Customer action required
- Yes
- Release
- 2025-Apr
- Assigned by
- Microsoft
- Weakness
- CWE-427: Uncontrolled Search Path Element
- MSRC revision
- 1.0
- Status pages
- Power Automate status
- First captured by us
- (from our first import of this list)
- Microsoft last modified
- Source
- Security updates · open the original at Microsoft
Microsoft's revision notes
- Revision 1.0, 2025-04-15:
Information published.
Microsoft says
Uncontrolled search path element in Power Automate allows an authorized attacker to disclose information over a network.
What Microsoft changed
One version so far. If Microsoft edits it, each change shows here with what was removed and added.
First version we captured ·
The text as we first saw it
Seen by us · Microsoft's timestamp · Microsoft's page
Related changes
Other changes for Power Automate
- Power Automate Elevation of Privilege Vulnerability
- Power Automate Elevation of Privilege Vulnerability
- Microsoft Power Automate Desktop Remote Code Execution Vulnerability
- Power Automate: Process mining - Enable Process Intelligence Studio in object-centric process mining · In development
- Power Automate: Desktop flows - Debug flows using variable default values · Launched
- Power Automate: Desktop flows - Measure time and cost savings for desktop flows · Launched
- Power Automate: Desktop flows - Encrypt and decrypt data with PGP · Launched
- Power Automate: Desktop flows - Configure notifications for desktop flow checker in admin portal · Launched