Azure AI Studio Cross-Tenant Model Artifact Access via Insecure Direct Object Reference
Overview
A critical Insecure Direct Object Reference (IDOR) vulnerability was discovered in the Azure AI Studio's Model Registry service. The vulnerability existed in a backend API endpoint responsible for serving model artifacts, such as weights and configuration files. An authenticated but low-privileged user could craft a direct API request to this endpoint, replacing their own project and model identifiers with guessable identifiers from another Azure tenant's project. The endpoint failed to properly validate that the requesting user's security principal was authorized for the resources of the target tenant. As a result, an attacker in Tenant A could successfully exfiltrate proprietary models, training data, and intellectual property from Tenant B. This bypasses the fundamental tenant isolation security boundary of the Azure cloud platform. The attack only required a valid Azure account and knowledge of the target's tenant ID and AI project name, which could potentially be discovered through public sources or other minor information disclosures. The vulnerability was reported responsibly by a security researcher through Microsoft's bug bounty program and was promptly patched before public disclosure.
Affected Systems
Testing Guide
1. This vulnerability was a server-side issue and cannot be tested by customers directly as it has been patched. 2. To verify the security of your resources, you can attempt to access a known model artifact URL from your workspace while authenticated as a user from a completely separate Azure tenant. 3. The request should now correctly result in a `403 Forbidden` or `404 Not Found` error, indicating the patch is effective.
Mitigation Steps
1. No user action is required; Microsoft has patched the backend API endpoint for all customers as of 2026-07-09. 2. Review Azure audit logs for any unauthorized access patterns to your AI Studio's Model Registry between June and July 2026. 3. Apply principle of least privilege for all users and service principals accessing Azure AI resources. 4. Use Azure Private Link to restrict access to your AI Studio workspace to your virtual network where possible.
Patch Details
Microsoft deployed a server-side patch on their global infrastructure on 2026-07-09, enforcing strict tenant boundary checks on all API requests.