CVE-2025-47733

An attacker without any permissions and without user interaction can force the Microsoft Power Apps server to execute network requests on behalf of the server — a classic SSRF (CWE-918) mechanism. This enables directing queries to internal network resources that are normally not accessible from the outside. In this way, an attacker can read data from resources available on the server side, including potentially internal services, environment metadata, or other sensitive information.

An attacker can gain unauthorized access to sensitive information and compromise data integrity (High Confidentiality, High Integrity according to CVSS vector). Exploitation may lead to further reconnaissance of the organization's internal infrastructure.

Apply patches available from the vendor in accordance with references published by Microsoft Security Response Center at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47733

Microsoft Power Apps — versions indicated in the vendor's references (Microsoft Security Response Center)