Teams meeting audio and roster data remain accessible via ACS Call Automation connectCall after a participant is removed from the meeting
Teams meeting audio and roster stay reachable via ACS Call Automation after a participant is removed.
Researcher Jacob Greenway disclosed that Microsoft Teams meeting audio and roster data remain accessible through Azure Communication Services Call Automation connectCall after a participant is removed. He reported the issue to the Microsoft Security Response Center before publishing a write-up and proof of concept. Testing was limited to meetings and tenants he owns. No CVE is named in the posted notice.
52