CVE-2026-41100: Improper access control in M365 Copilot allows an authorized attacker to perform spoofing locally.

CVE-2026-41100 is a vulnerability in Microsoft 365 Copilot where improper access control (weak rules that don't properly check who should be allowed to do something) allows an authorized attacker to perform spoofing (impersonating someone or something else) on a local system. The vulnerability has a CVSS 4.0 severity rating (a moderate security concern on a 0-10 scale).