CVE-2025-49731: Microsoft Teams Elevation of Privilege Vulnerability

Severity: low (CVSS 3.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-07-08 · updated 2026-06-17
Weakness: CWE-280

Description

Improper handling of insufficient permissions or privileges in Microsoft Teams allows an authorized attacker to elevate privileges over a network.

Affected products

Microsoft Teams: before 1.0.0.2025112902; before 7.10.1 — fixed in 1.0.0.2025112902, 7.10.1
Microsoft Teams for Desktop: from 1.0.0 before 25060212643 — fixed in 25060212643
Microsoft Teams: from 1.0.0 before 1.0.0.2025112902 — fixed in 1.0.0.2025112902

How to fix

Upgrade to a fixed version: Microsoft Teams 1.0.0.2025112902, 7.10.1; Microsoft Teams for Desktop 25060212643; Microsoft Teams 1.0.0.2025112902. Check the vendor advisory for mitigations.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49731

Get alerted when CVE-2025-49731 or the next vulnerability affects your stack