Authenticated privilege escalation

Improper access control in Microsoft Purview eDiscovery allows remote authenticated users to gain elevated privileges over a network. Microsoft has not publicly disclosed the affected component or the specific authorization check that fails, and the CNA and vendor records describe only an improper access control condition in the hosted service. Reachability requires valid access to Purview eDiscovery, and current public records describe privilege gain within the service but do not disclose a path to arbitrary code execution outside it.