# Entra ID Actor tokens enabled cross-tenant Global Admin

Source: https://startwithidentity.com/cves/cve-2025-55241/
Last updated: 2026-08-13
License: content by Start with Identity. Cite the source URL.

---

## What broke

In July 2025 Dirk-jan Mollema (Outsider Security) found that undocumented "Actor tokens" plus a tenant-validation gap in the legacy Azure AD Graph API let an attacker impersonate any user in any [Entra ID](https://startwithidentity.com/vendors/iam/microsoft-entra/) tenant, including Global Admin. The request did not trip MFA, Conditional Access, or a useful audit trail. Microsoft mitigated the service within days of the July 14 report and published the CVE on 4 September 2025. MSRC told Dark Reading it found no evidence of abuse and framed the CVE as a no-customer-action disclosure.

NVD and several trackers list CVSS 10.0. MSRC assessments have been cited at 9.0 and 8.7. Treat the discrepancy as a scoring argument, not as a reason to downgrade the blast radius.

## Why it matters

This is the defining cloud-identity CVE of the period. A single backend token design, never meant as a customer-facing control, became a global tenant-boundary failure. Identity teams usually hunt for phishing, token theft, and consent grants. This class of bug never shows up in those hunts, because the forged session is indistinguishable from a first-party Microsoft call and historically produced no logs.

It also shows the cost of leaving legacy APIs alive. Azure AD Graph was already on a retirement path. The validation flaw lived there, not in Microsoft Graph.

## What to do

- Treat "no customer action" cloud CVEs as detection gaps, not as closed risk. You cannot patch a service you do not run, but you can retire Azure AD Graph, inventory high-privilege app registrations and service principals, and demand tenant-boundary telemetry from the vendor.
- Watch for unexpected Global Admin or application-permission grants that have no matching interactive sign-in.
- Bind privileged roles to [phishing-resistant MFA](https://startwithidentity.com/glossary/phishing-resistant-mfa/) and Conditional Access even when a backend token path claims to skip them. Defense in depth still matters when the next Actor-token equivalent appears.
- Read the [Entra ID vendor profile](https://startwithidentity.com/vendors/iam/microsoft-entra/) alongside this brief when you brief leadership. The lesson is architectural, not a Tuesday patch.

## Sources

- [NVD: CVE-2025-55241](https://nvd.nist.gov/vuln/detail/CVE-2025-55241)
- Dirk-jan Mollema / Outsider Security disclosure (July 2025) and MSRC customer guidance