Microsoft 365 Copilot data exposure via over-permissive SharePoint indexing
Date: 2024-06
Affected: Microsoft 365 Copilot customers
Attack vector: data-exfiltration
Category: real-world
Severity: High

Enterprise deployments of Microsoft 365 Copilot were found to surface confidential SharePoint data (salaries, M&A docs, HR files) to employees who had inherited overly broad permissions, because Copilot retrieved everything the user technically had access to.


Mitigations:

Architectural layers (MAESTRO):