Missing authorization in Azure Machine Learning allows an authorized attacker to elevate privileges over a network.
Date: 2025-07
Affected: microsoft/azure_machine_learning
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2025-49747
CWE: CWE-862
CVSS: 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

Missing authorization in Azure Machine Learning allows an authorized attacker to elevate privileges over a network.


Mitigations:

Architectural layers (MAESTRO):