CVE-2026-94510

Executive Summary

CVE-2026-94510 is an authorization bypass vulnerability (CWE-639, user-controlled key) in Microsoft Bookings that permits an unauthorized, unauthenticated network attacker to elevate privileges. With a CVSS v3.1 base score of 9.9, exploitation requires no privileges or user interaction and crosses a security scope boundary, making it a critical-severity issue. Because Bookings is delivered as a Microsoft 365 cloud service, every tenant exposing the scheduling surface may be affected until Microsoft applies a server-side fix.

Technical Analysis

The vulnerability class is CWE-639: Authorization Bypass Through User-Controlled Key. In this class, an application exposes a reference (an object identifier, tenant identifier, or resource key) that is supplied or influenced by the client, and the server performs the authorization decision using that client-controlled value rather than binding the request to the authenticated principal. The attacker manipulates the key so that the authorization check evaluates against an object or scope they legitimately can reach, while the subsequent operation is carried out against a different, higher-privileged object.

The NVD description states the impact is privilege elevation over a network: "Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to elevate privileges over a network." This indicates the flaw is reachable pre-authentication (AV:N, PR:N, UI:N) and that the resulting impact crosses a trust boundary (S:C). Per the CVSS subscores, integrity impact is High, while confidentiality and availability are Low, which is consistent with an attacker modifying data or state associated with another principal rather than exfiltrating bulk data or causing a denial of service.

Because Microsoft Bookings is a multi-tenant SaaS application, the most plausible mapping of the class to this product is that a user-controlled key selecting a booking page, booking entity, or tenant-scoped resource is not validated against the caller's identity before a privileged operation executes. No function names, endpoints, parameters, file paths, or API routes are provided in the source data; accordingly, no implementation-level identifiers are asserted here. Any statement about exact request parameters, GUID formats, or handler names would be speculative and is deliberately omitted.

Two additional constraints matter for defenders. First, no affected version range has been published, which is typical for cloud-hosted services where remediation is applied server-side without a customer-visible version increment. Second, no public proof-of-concept, Nuclei template, or exploit code exists in the provided intelligence, so the attack chain below is inferred strictly from the vulnerability class and the CVSS vector rather than from observed exploit artifacts.

Exploitation Scenarios

The following chain is an inference based on CWE-639 mechanics and the CVSS vector. No public PoC is available; the attack chain is inferred from vulnerability class.

1. Reconnaissance / target identification. The attacker identifies an organization using Microsoft Bookings, since the service is publicly reachable over the network (AV:N) and requires no account to begin interacting with exposed scheduling surfaces (PR:N). Enumeration focuses on Bookings pages and any tenant-scoped identifiers that the client is permitted to submit.

2. Triggering the flaw class. The attacker submits a request in which the authorization-relevant key — the identifier used by the server to decide whether the operation is allowed — is supplied or modified by the client. In a CWE-639 defect, the server consumes this client-controlled value when making its authorization decision. By substituting a key that satisfies the check while pointing at a different, more privileged resource, the attacker causes the authorization logic to approve an operation it should reject. No user interaction is required (UI:N), and the attacker holds no valid privileged session (PR:N).

3. Payload / execution method. At the vulnerability-class level, the "payload" is a manipulated key value embedded in a legitimate request to the Bookings service, rather than exploit code or a memory-corruption primitive. Execution is achieved by the server acting on the mis-resolved object with elevated authority. Because the source data provides no endpoint or parameter names, the specific request shape cannot be described without fabrication.

4. Post-exploitation impact. Successful abuse yields privilege elevation across a scope boundary (S:C). Integrity impact is High: the attacker can modify or act upon resources beyond their authorization. Confidentiality and availability impact are Low, consistent with a targeted privilege-escalation objective rather than mass data theft or service disruption. In a multi-tenant scheduling context, the elevated state could potentially be leveraged as a foothold for further action within the affected tenant scope.

Impact Assessment

The CVSS v3.1 base score of 9.9 reflects a near-worst-case profile: network reachability, low attack complexity, no privileges, no user interaction, and a scope change. The scope-change component is the most consequential: the vulnerable component's authorization boundary is crossed, meaning the attacker can affect assets that the vulnerable component itself is not authorized to govern. This is what drives the score toward critical even though confidentiality and availability are rated Low.

Business impact centers on unauthorized state change to scheduling and booking data and to the tenant scope associated with it. Because Bookings commonly handles external-facing appointment flows, an integrity-focused bypass can corrupt business processes, misroute meetings, or misrepresent availability and ownership. Blast radius is potentially every tenant with an exposed Bookings surface until the provider remediates server-side; customers cannot rely on local patching of a client component. There is no evidence of exploitation in the wild, no CISA KEV listing, and no exploit code or PoC in the provided data, so current real-world impact is assessed as potential rather than observed.

Detection Guidance

Sigma Rule

title: Potential Microsoft Bookings Authorization Bypass via User-Controlled Key
id: 8f2c1a44-7b6e-4d1a-9c3e-bookings639
status: experimental
description: Detects anomalous access to Microsoft Bookings resources where client-supplied identifiers may drive authorization decisions (CWE-639).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-94510
author: Threat Intelligence
date: 2026/01/01
logsource:
  product: m365
  service: audit
detection:
  selection_op:
    Operation|contains:
      - 'Bookings'
  selection_anomaly:
    - UserId|endswith: '@'
    - ClientIP|exists: true
  filter_known:
    ResultStatus: 'Success'
  condition: selection_op and selection_anomaly and not filter_known
fields:
  - UserId
  - ClientIP
  - Operation
  - ObjectId
falsepositives:
  - Legitimate administrative activity
  - Automated provisioning services
level: high

YARA Rule

rule CVE_2026_94510_Bookings_Authz_Bypass_Indicators
{
    meta:
        description = "Hunts for artifacts referencing CVE-2026-94510 Microsoft Bookings authorization bypass (CWE-639)"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-94510"
        severity = "critical"
    strings:
        $cve = "CVE-2026-94510" ascii wide nocase
        $bk1 = "Microsoft Bookings" ascii wide nocase
        $bk2 = "bookings.microsoft.com" ascii wide nocase
        $cw  = "CWE-639" ascii wide nocase
    condition:
        any of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-94510 Microsoft Bookings Potential Authorization Bypass (User-Controlled Key)"; flow:established,to_server; http.host; content:"bookings.microsoft.com"; http.uri; content:"?"; http.header; content:"Authorization"; pcre:"/(id|key|tenant|owner|user)%?3?[Dd]/Ui"; reference:cve,2026-94510; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-94510; classtype:attempted-user; sid:202694510; rev:1;)

Elastic Detection

sequence by user.id, source.ip with maxspan=5m
  [ network where network.protocol == "https" and
      url.domain == "bookings.microsoft.com" and
      url.query contains "id=" ]
  [ network where network.protocol == "https" and
      url.domain == "bookings.microsoft.com" and
      http.response.status_code == 200 and
      not user.id : null ]

Splunk SPL Query

index=m365 sourcetype="o365:management:activity" Workload=Bookings
| search Operation=*Bookings* OR ObjectId=*
| eval suspicious=if(match(ClientIP,"^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)"),0,1)
| where suspicious=1 AND ResultStatus="Success"
| stats count min(_time) as first_seen max(_time) as last_seen values(Operation) as ops values(ObjectId) as objects by UserId ClientIP
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="microsoft,bookings,cve-2026-94510">
  <rule id="100945" level="12">
    <decoded_as>json</decoded_as>
    <field name="Workload">Bookings</field>
    <field name="Operation">\.*Bookings\.*</field>
    <field name="ResultStatus">Success</field>
    <description>CVE-2026-94510: Possible Microsoft Bookings authorization bypass via user-controlled key</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>authorization_bypass,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version data has been published in the provided intelligence.

1. Immediate mitigations. Restrict which identities and external parties can interact with Bookings surfaces; disable public booking pages that are not operationally required. Enforce least privilege on any account tied to Bookings administration and review conditional access policies so that anonymous or unauthenticated reach to scheduling endpoints is minimized. Continuously monitor Microsoft 365 audit logs for Bookings operations returning success from unexpected source IPs or identities.

2. Patch / upgrade steps. No patch reference exists as of this report. Because Bookings is a cloud service, remediation must come from Microsoft's server-side fix; customers cannot apply a client update. Track the Microsoft Security Response Center and Microsoft 365 message center for an out-of-band advisory, and subscribe to NVD entry updates for CVE-2026-94510 to detect when a vendor reference is added.

3. Long-term hardening. Treat all client-supplied identifiers as untrusted and require server-side binding of authorization decisions to the authenticated principal — the core remediation for CWE-639. Adopt centralized authorization review for multi-tenant SaaS surfaces, enable comprehensive audit logging with alerting on anomalous cross-object access, and schedule periodic re-validation of third-party and built-in Microsoft 365 integrations that expose scheduling or sharing functionality. Until a fix is confirmed, assume integrity-focused exposure on any tenant with an exposed Bookings surface.

References

• NVD — CVE-2026-94510: https://nvd.nist.gov/vuln/detail/CVE-2026-94510
• MITRE CWE-639 — Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Microsoft Security Response Center (MSRC) — vendor advisory tracking for cloud service fixes: https://msrc.microsoft.com/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-94510 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog