CVE-2026-21520

Copilot Studio sensitive-information disclosure (ShareLeak)

Microsoft · Copilot Studio

First documented disclosure · Review checkpoint

Summary

Microsoft describes an unauthenticated information-disclosure flaw; researchers connect it to indirect prompt injection through SharePoint forms.

Severity and exploitation evidence

High · 7.5/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed sources do not establish malicious exploitation. A published proof of concept is not evidence of a customer compromise.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Untrusted form content could redirect a connected agent’s handling of information.

Conditions required

An affected Copilot Studio workflow consumes attacker-controlled form content and has access to connected data.

Potential impact

Sensitive connected information could be sent outside its intended audience.

Affected versions and configurations

Copilot Studio service; no customer-installable version range is provided.

Fix and mitigation status

Service-side remediation reported; no local patch version specified.

Practical next steps

Verify service guidance, constrain connector permissions and destinations, and review workflows processing external forms.

Operating lesson

External content should not decide where privileged agent data is sent.

Evidence and limits

Microsoft records January 22; Capsule’s later research gives a conflicting January 15 CVE date. The registry retains Microsoft’s date and does not infer a customer breach.

Related incident and research records

Related records can include laboratory demonstrations; a relationship does not itself establish exploitation.

Sources