PrivacyMedium
Microsoft 365 Copilot Vulnerability Allegedly Allowed File Access Without Audit Log Entry
- Occurred
- Jul 4, 2025
- Published
- Aug 18, 2025
- Source
- AI Incident Database
Summary
A vulnerability in Microsoft 365 Copilot reportedly allowed users to access and summarize files without generating audit log entries, allegedly undermining traceability and compliance. Security researcher Zack Korman disclosed the issue to Microsoft, which reportedly classified it as "important" and fixed it on August 17, 2025, but reportedly chose not to notify customers or assign a CVE.
Developers
- Microsoft
Deployers
- Microsoft
Harmed parties
- Organizations relying on audit logs for compliance and security
- Microsoft 365 Copilot enterprise customers
Classification
Category confidence: 85%
Severity confidence: 80%
Rationale: Vulnerability allowed file access without audit logs, impacting traceability and compliance.
Classifier: Qwen/Qwen3.5-35B-A3B-FP8