CVE-2026-70213 in Power Apps
Summary
by MITRE • 10/14/2026
Origin validation error in Microsoft Power Apps allows an authorized attacker to execute code over a network.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified as an origin validation error within Microsoft Power Apps represents a critical flaw in the application's security architecture, specifically concerning how it handles cross-origin resource sharing and request authentication. This issue stems from insufficient verification of the Origin header or related HTTP headers during API requests, allowing malicious actors to bypass intended access controls. In modern web applications, particularly those built on low-code platforms like Power Apps that rely heavily on JavaScript-based client-side logic and RESTful APIs, strict origin validation is essential to prevent Cross-Site Request Forgery (CSRF) attacks and unauthorized data exfiltration. When this validation fails, the application may accept requests from untrusted domains or spoofed sources as if they were legitimate user interactions, thereby undermining the fundamental trust model of the platform.
From a technical perspective, the flaw likely involves a misconfiguration in the server-side logic that processes incoming HTTP requests without adequately checking whether the request originated from an authorized domain registered within the Power Apps environment. This oversight permits an attacker to craft malicious web pages or scripts hosted on external servers that can trigger state-changing actions within Microsoft Power Apps using the victim's active session cookies and authentication tokens. Because modern browsers enforce same-origin policies, a direct script-based attack might be mitigated by browser security features; however, if the application fails to validate the Origin header correctly, it may process requests sent via non-browser clients or through specific vector types that do not trigger standard CORS preflight checks effectively. This allows an authorized attacker who has gained access to a user's session or can induce a victim to load malicious content to execute arbitrary code over the network by leveraging the trusted relationship between the browser and the Power Apps backend services.
The operational impact of this vulnerability is severe, as it directly compromises the confidentiality, integrity, and availability of data processed through Microsoft Power Apps. An attacker could exploit this flaw to perform actions on behalf of authenticated users without their knowledge or consent. This includes reading sensitive business logic, extracting confidential data stored in connected databases, modifying application configurations, or executing administrative commands if the compromised account possesses elevated privileges. Since Power Apps is often used for mission-critical enterprise workflows involving financial transactions, customer relationship management, and internal operations, such an exploitation could lead to significant financial loss, regulatory non-compliance under standards like GDPR or HIPAA, and reputational damage. The ability to execute code over a network implies that the attacker can potentially escalate privileges further by injecting malicious payloads into subsequent requests or manipulating data flows between connected services.
This vulnerability aligns with CWE-346, which describes an Origin Validation Error where security decisions are based on untrusted input such as HTTP headers without proper validation. It also maps to MITRE ATT&CK technique T1534, known as Internal Spearphishing or more broadly within the context of web attacks, it relates to Cross-Site Request Forgery (CSRF) mechanisms found in techniques like T1078 if combined with credential theft, though primarily it reflects a failure in access control validation. To mitigate this risk, organizations must ensure that Microsoft Power Apps is updated to the latest version where such origin checks are strictly enforced by default. Administrators should review and restrict allowed origins within the app settings, ensuring only trusted domains can interact with the application's APIs. Additionally, implementing robust Content Security Policy (CSP) headers and utilizing anti-CSRF tokens for state-changing operations can provide defense-in-depth layers that compensate for potential header validation gaps. Regular security audits focusing on API endpoint configurations and continuous monitoring of anomalous request patterns are also recommended to detect any attempted exploitation activities early in the attack lifecycle.