CVE-2025-24989: Microsoft Power Pages Improper Access Control Vulnerability

CVE-2025-24989 is an improper access control vulnerability in Microsoft Power Pages. It allows an unauthorized attacker to elevate privileges over a network, potentially bypassing the user registration control. This matters because Power Pages often hosts public-facing or semi-public business portals; successful abuse can grant elevated access without proper registration or authorization checks, increasing risk of unauthorized data access or further compromise of the environment.

Defenders should treat this as a cloud-service access-control issue and confirm all product-specific details against the Microsoft advisory. CISA notes the required action is to apply mitigations per vendor instructions, follow BOD 22-01 guidance for cloud services, or discontinue use if mitigations are unavailable. Ransomware use is not documented for this CVE.

How it works

The weakness is classified as CWE-284 (Improper Access Control). In this class of flaw, the application fails to enforce correct authorization boundaries on sensitive operations. According to the CISA summary, an unauthorized attacker can elevate privileges over a network and potentially bypass the user registration control in Microsoft Power Pages.

At a high level, an attacker who can reach the affected Power Pages surface may interact with registration or access-control logic in a way that grants higher privileges than intended. Exact request patterns, endpoints, or conditions are not provided here; treat any public technical write-ups as unconfirmed until validated against the vendor advisory. The impact is privilege elevation rather than remote code execution, but elevated access on a portal can still expose data or administrative functions.

Am I affected? How to find it in your systems

Microsoft Power Pages is a low-code platform commonly used to build external-facing websites and portals that integrate with Microsoft Dataverse and other Microsoft cloud services. It typically runs as a cloud-hosted service rather than on-premises software.

• Inventory all Power Pages sites and associated environments in your Microsoft Power Platform or Dynamics 365 tenant. Review the list of published portals and their authentication/registration settings.
• Identify sites that allow user registration or that expose any self-service access controls. Confirm whether the configuration matches the vulnerable state described in the vendor advisory.
• Because exact affected versions or build numbers are not stated in the provided facts, check the Microsoft security update guide or Power Pages release notes for the precise scope. Do not assume any particular version is safe without confirmation.
• For detection of possible exploitation, review portal and Dataverse audit logs for unexpected privilege changes, new high-privilege accounts created outside normal registration flows, or anomalous anonymous-to-authenticated transitions. Cloud activity logs and Microsoft 365 Defender or Entra ID sign-in logs may also show unusual access patterns originating from the portal.

If you lack centralized inventory, query the Power Platform admin center or use available Microsoft Graph / Power Platform APIs to enumerate sites. Engage application owners who manage customer or partner portals.

How to remediate

Patching or applying the vendor-supplied mitigation is the primary action. Follow Microsoft’s instructions for this CVE exactly; the CISA required action is to apply mitigations per vendor instructions, follow BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

• Apply the update or configuration change named in the Microsoft advisory as soon as it is available for your environment.
• After remediation, re-validate access-control and registration settings on every Power Pages site. Ensure that registration and privilege-assignment paths enforce intended authorization.
• For this class of improper-access-control issues, review and tighten role-based access, least-privilege assignments, and any custom registration or invitation workflows. Disable unnecessary anonymous or self-registration features where business needs allow.
• Document the change and re-test portal authentication and authorization paths.

If you can't patch immediately

Until the vendor mitigation can be applied, reduce exposure with compensating controls appropriate to a cloud portal service.

• Limit network reachability of the portal where possible (IP allow-listing, conditional access policies, or geo-restrictions) so only expected users can reach registration or login surfaces.
• If the product supports it, temporarily disable or restrict the user-registration feature that the vulnerability may bypass. Confirm the exact setting against the vendor advisory.
• Apply virtual patching or WAF rules that inspect and block anomalous registration or privilege-related requests if your edge controls support Power Pages traffic. Rules must be tuned carefully to avoid breaking legitimate use.
• Increase monitoring and alerting on portal audit logs, privilege-elevation events, and new account creation. Forward relevant logs to your SIEM and create detections for unexpected elevation patterns.
• Segment any backend systems or Dataverse environments the portal can reach so that elevated portal access does not automatically grant broad internal privileges.
• If risk remains unacceptable and no mitigation is available, follow the CISA guidance to discontinue use of the affected product until a fix can be applied.

If your data may have been exposed

Actively exploited access-control vulnerabilities can lead to unauthorized access and subsequent data exposure or account takeover. Although ransomware use is not documented for this CVE, any privilege elevation on a business portal warrants investigation of portal logs, Dataverse records, and related identity activity for signs of abuse.

If you believe accounts or data may have been accessed, follow your incident-response process: contain affected portals, reset credentials of potentially elevated accounts, and review data-access logs. Separately, individuals can run a free exposure scan of their email addresses against known breach data sets to check whether their credentials appear in prior public breaches, which can help prioritize password resets and monitoring.