AVID-2026-R1682

Description

Azure Bot Framework SDK Elevation of Privilege Vulnerability (CVE-2025-30389)

Details

Improper authorization in Azure Bot Framework SDK allows an unauthorized attacker to elevate privileges over a network.

Reason for inclusion in AVID: The CVE-2025-30389 vulnerability is a software security issue in the Azure Bot Framework SDK, enabling elevation of privilege via improper authorization. The Bot Framework SDK is a component used in building and deploying AI-powered chatbots and AI systems, placing it squarely in the software supply chain for general-purpose AI systems (deployment/serving stacks and orchestration). It is not hardware/firmware-only. The report provides clear vulnerability behavior, affected product (Azure Bot Service), and a CVSS score indicating high risk, offering sufficient evidence for AVID curation.

References

Affected or Relevant Artifacts

Developer: Microsoft
Deployer: Microsoft
Artifact Details:

Type	Name
System	Azure AI Bot Service

Impact

AVID Taxonomy Categorization

Risk domains: Security
SEP subcategories: S0100: Software Vulnerability
Lifecycle stages: L06: Deployment

CVSS

Version	3.1
Vector String	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C
Base Score	8.7
Base Severity	🔴 High

CWE

ID	Description
CWE-285	CWE-285: Improper Authorization

Other information

Report Type: Advisory
Credits:
Date Reported: 2025-04-30
Version: 0.3.3
AVID Entry