Azure Spring Apps Elevation of Privilege Vulnerability

CVE-2026-50338 is an elevation of privilege vulnerability in Azure Spring Apps (rated Important, CVSS 8.2).

1 version

Microsoft id: CVE-2026-50338
Products: Azure Spring Apps
Severity: Important
Impact: Elevation of Privilege
CVSS: 8.2
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C
Exploited: No
Publicly disclosed: No
Exploitability: Exploitation Less Likely
Customer action required: Yes
Release: 2026-Jul
Assigned by: Microsoft
Weakness: CWE-287: Improper Authentication
MSRC revision: 1.0
Status pages: Azure Spring Apps status
First captured by us: 13 Nov 2026, 15:05 UTC (from our first import of this list)
Microsoft last modified: 14 Jul 2026, 14:00 UTC
Source: Security updates · open the original at Microsoft

Microsoft's revision notes

Improper authentication in Azure Spring Apps allows an authorized attacker to elevate privileges over a network.

Security updates, 14:00 UTC, 14 Jul

One version so far. If Microsoft edits it, each change shows here with what was removed and added.

First version we captured · 15:05 UTC, 13 Nov
The text as we first saw it
Seen by us 15:05 UTC, 13 Nov · Microsoft's timestamp 14:00 UTC, 14 Jul · Microsoft's page