Improper Access Control in Microsoft Power Pages (CVE‑2025‑24989) Risks Privilege Escalation
What It Is – Microsoft Power Pages contains an improper access‑control flaw that lets an unauthenticated attacker elevate privileges and bypass the user‑registration gate.
Exploitability – The vulnerability is publicly disclosed (CVE‑2025‑24989) and rated High (CVSS ≈ 8.5). No public exploit has been observed yet, but the attack vector is network‑based and feasible with minimal effort.
Affected Products – Microsoft Power Pages (part of the Power Platform) across all tenant deployments.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous verification of access‑control policies and evidence that least‑privilege rules are enforced.
- Highlights gaps in audit‑ready logging of privilege‑escalation attempts—critical for defensible compliance reporting.
- Signals to enterprise buyers that a robust identity governance program (aligned with NIST CSF 2.0) is a prerequisite for trusting low‑code web‑app services.
Recommended Actions
- Deploy Microsoft’s security update for CVE‑2025‑24989 immediately.
- Conduct a rapid review of Power Pages access‑control settings; enforce least‑privilege and restrict anonymous registration.
- Enable comprehensive logging of authentication and privilege‑change events; integrate logs with a SIEM for continuous monitoring.
- Capture evidence of the updated controls in your Trust Center to demonstrate audit readiness.
Source: CISA KEV – CVE‑2025‑24989