CVE-2025-55241Entra ID Actor tokens enabled cross-tenant Global Admin

What broke

In July 2025 Dirk-jan Mollema (Outsider Security) found that undocumented "Actor tokens" plus a tenant-validation gap in the legacy Azure AD Graph API let an attacker impersonate any user in any Entra ID tenant, including Global Admin. The request did not trip MFA, Conditional Access, or a useful audit trail. Microsoft mitigated the service within days of the July 14 report and published the CVE on 4 September 2025. MSRC told Dark Reading it found no evidence of abuse and framed the CVE as a no-customer-action disclosure.

NVD and several trackers list CVSS 10.0. MSRC assessments have been cited at 9.0 and 8.7. Treat the discrepancy as a scoring argument, not as a reason to downgrade the blast radius.

Why it matters

This is the defining cloud-identity CVE of the period. A single backend token design, never meant as a customer-facing control, became a global tenant-boundary failure. Identity teams usually hunt for phishing, token theft, and consent grants. This class of bug never shows up in those hunts, because the forged session is indistinguishable from a first-party Microsoft call and historically produced no logs.

It also shows the cost of leaving legacy APIs alive. Azure AD Graph was already on a retirement path. The validation flaw lived there, not in Microsoft Graph.

What to do

• Treat "no customer action" cloud CVEs as detection gaps, not as closed risk. You cannot patch a service you do not run, but you can retire Azure AD Graph, inventory high-privilege app registrations and service principals, and demand tenant-boundary telemetry from the vendor.
• Watch for unexpected Global Admin or application-permission grants that have no matching interactive sign-in.
• Bind privileged roles to phishing-resistant MFA and Conditional Access even when a backend token path claims to skip them. Defense in depth still matters when the next Actor-token equivalent appears.
• Read the Entra ID vendor profile alongside this brief when you brief leadership. The lesson is architectural, not a Tuesday patch.

Sources

• NVD: CVE-2025-55241
• Dirk-jan Mollema / Outsider Security disclosure (July 2025) and MSRC customer guidance