Read the docs
TI-2021-18191 Aliases CVE-2021-41372GHSA-3w9m-7j3j-w9p6

Power BI Report Server Spoofing Vulnerability

Priority MEDIUM 42CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Microsoft. Impact type from Microsoft.

Summary

A Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) vulnerability exists when Power BI Report Server Template file (pbix) containing HTML files is uploaded to the server and HTML files are accessed directly by the victim. Combining these 2 vulnerabilities together, an attacker is able to upload malicious Power BI templates files to the server using the victim's session and run scripts in the security context of the user and perform privilege escalation in case the victim has admin privileges when the victim access one of the HTML files present in the malicious Power BI template uploaded. The security update addresses the vulnerability by helping to ensure that Power BI Report Server properly sanitize file uploads.

Why it matters now

EPSS 0.00682 52nd percentileScored 2026-11-07
Fix Fixed Microsoft: 1 update

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftPower BI Report Server version 1.11.8091.104681.0.0.0 to before 1.11.8091.104681.11.8091.10468Patch availableCNA
MicrosoftPower BI Report Server version 1.12.7977.295371.0.0.0 to before 1.12.7977.295371.12.7977.29537Patch availableCNA
  • Power BI Report Server version 1.11.8091.10468 VendorMicrosoft Affected 1.0.0.0 to before 1.11.8091.10468 Fixed in 1.11.8091.10468 Patch available CNA
  • Power BI Report Server version 1.12.7977.29537 VendorMicrosoft Affected 1.0.0.0 to before 1.12.7977.29537 Fixed in 1.12.7977.29537 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:power_bi_report_server:15.0.1107.165:*:*:*:*:*:*:*15.0.1107.165VulnerableMicrosoft
  • cpe:2.3:a:microsoft:power_bi_report_server:15.0.1107.165:*:*:*:*:*:*:* Versions 15.0.1107.165 Vulnerable ·Microsoft

Remediation

Microsoft 1 update

  • KB5007903
    Security Update
    • Power BI Report Server version 1.11.8091.10468 1.11.8091.10468
    • Power BI Report Server version 1.12.7977.29537 1.12.7977.29537

Vendor assessments

Microsoft

Microsoft's page for this CVE →

Impact
Spoofing
Exploited
No
Publicly disclosed
No
Exploitability
Exploitation Less Likely

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-41372
  2. 2026-10-03 Alias added: GHSA-3w9m-7j3j-w9p6

References

Patch 2

  • TI-2026-46897 Power BI Remote Code Execution Vulnerability CVSS 3.1HIGH 8.8
  • TI-2026-17140 Power BI Remote Code Execution Vulnerability CVSS 3.1HIGH 8.8
  • TI-2024-29123 Power BI Report Server Spoofing Vulnerability CVSS 3.1HIGH 8.8
  • TI-2021-11970 Power BI Remote Code Execution Vulnerability CVSS 3.1HIGH 8.8
  • TI-2021-08468 Microsoft Power BI Information Disclosure Vulnerability CVSS 3.1HIGH 7.7
  • TI-2019-01046 Cross-site scripting in Microsoft SQL Server 2017 Reporting Services CVSS 3.1MEDIUM 6.1
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences