Unsecured API Exposed Data of More Than 50,000 Azure AD Users
Summary
An unauthenticated API endpoint issued overprivileged Microsoft Graph tokens, making data associated with more than 50,000 Azure AD users—including executive information—accessible.
Key points
- A JavaScript bundle exposed an unauthenticated API endpoint that issued Microsoft Graph tokens.
- The tokens had User.Read.All and AccessReview.Read.All permissions, allowing access to user profiles and identity-governance data.
- Accessible information included names, contact details, job titles, reporting structures, role assignments, and access-review configurations.
- The article says records for newly added users continued to be returned; it does not report confirmed exploitation or data theft.
- Recommended steps include restricting the endpoint, revoking exposed tokens, reducing permissions, and monitoring Microsoft Graph activity.
Article Details
- Incident Type
- Exposure of employee data through a publicly accessible unauthenticated API endpoint that issued Microsoft Graph access tokens with excessive permissions
- Data Types Exposed
- Names
- Job titles
- Contact details
- Reporting structures
- User principal names
- Personal identifiers
- Access role assignments
- Access review configurations and other governance details
- Affected Records
- More than 50,000 users; the endpoint also returned records for newly added users.
- Operational Impact
- Sensitive employee and identity-governance data was accessible, including executive-level data. No actual operational disruption is reported.
- Ransom Or Extortion
- None reported.
- Claim Status
- confirmed
Products
Azure ADThis endpoint granted access tokens to Microsoft Graph with elevated privileges, ultimately leading to unauthorized exposure of sensitive data belonging to more than 50,000 Azure AD users.BeVigilCloudSEK’s BeVigil platform recently identified a critical security lapse on a publicly accessible of an aviation giant.Microsoft GraphThis endpoint granted access tokens to Microsoft Graph with elevated privileges, ultimately leading to unauthorized exposure of sensitive data belonging to more than 50,000 Azure AD users.