Lack of service-side validation allows group guest user restrictions bypass via OWA

A recent exploration into how OWA enforces guest user restrictions for Microsoft 365 Group releaved that client-side checks are used, and in turn restrictions could be bypassed by crafting a request with modified payload. After doing the responsible thing and reporting this issue to Microsoft, I am now bringing you some additional details on it, after the corresponding fix has been rolled out worldwide. …

Continue readingLack of service-side validation allows group guest user restrictions bypass via OWA