Skip to content
OpenAdvisories
High MSRC-CVE-2026-26149 1 CVE

Microsoft Power Apps Desktop Client Spoofing Vulnerability

Published Apr 14, 2026 · Updated Apr 27, 2026 · Revision 3

Vendor: Microsoft

Summary

Impact: Spoofing. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

According to the CVSS metric, user interaction is required (UI:R) and privileges required are Low (PR:L). What does that mean for this vulnerability?
A user must interact with a malicious Power Apps canvas app, such as by opening or using it.
Additionally, an attacker only needs basic capabilities to create or share a Power App; they do not need administrative access.

According to the CVSS metric, successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?
This vulnerability could lead to the attacker gaining the ability to interact with other tenant’s applications and content.

How could an attacker exploit this vulnerability?
An attacker could create a malicious Power Apps canvas app that includes an external protocol link disguised with leading whitespace. When a user opens the app, the resulting warning dialog may appear incomplete or misleading. If the user proceeds, the app could trigger an external protocol call that performs unintended actions on the user’s device.

Security updates
3.26032.10.0 — https://apps.microsoft.com/detail/9mvc8p1q3b29?hl=en-US&gl=US

Vulnerabilities 1

  • Critical 9.0
    CVE-2026-26149

    Microsoft Power Apps Desktop Client Spoofing Vulnerability

    Improper neutralization of escape, meta, or control sequences in Microsoft Power Apps allows an authorized attacker to perform spoofing over a network.

    Microsoft Microsoft Power Apps Desktop Client

Revision history

  1. #3

    Change the name of the affected software from **Microsoft Power Apps** to **Microsoft Power Apps Desktop Client**. This is an informational change only.

  2. #2

    The security impact for this vulnerability has been revised. This change does not affect the available security updates. Customers should continue to install the recommended updates to remain protected from this vulnerability.

  3. #1

    Information published.

References