Critical Microsoft OneDrive Flaw Exposes User Data via Over-Permissive OAuth Scopes

Security researchers have uncovered a significant vulnerability within Microsoft OneDrive's File Picker feature—a discovery that casts a long shadow across the landscape of cloud-based file management and third-party integration. OneDrive, widely used by both consumers and enterprises for its seamless cloud storage and file sharing capabilities, is now under scrutiny, as experts warn that excessive permission grants and lax token management could expose sensitive user data to malicious actors. This situation is made even more urgent by the integration of OneDrive with a broad array of popular applications and the apparent lack of an immediate fix from Microsoft.

The Anatomy of the OneDrive File Picker Flaw​

The OneDrive File Picker is designed to simplify document and file sharing by allowing users to access and manage their OneDrive data through third-party web and mobile applications. At its core, this system leverages OAuth 2.0, an industry-standard protocol for authorization, which enables users to grant limited access to their resources without sharing passwords.
Yet, what is meant to facilitate convenience has become a source of anxiety for security professionals and users alike. According to a detailed report by Oasis Security, the crux of the vulnerability lies in the File Picker’s over-permissive OAuth scopes. Rather than allowing fine-grained selection of what third-party apps can access (e.g., only specific folders or files), File Picker requests broad, wholesale access to the user's entire OneDrive archive. This design flaw is exacerbated by consent screens that do not make the scope of access clear to end users. The end result: users may inadvertently grant applications the ability to read, change, or even exfiltrate all of their cloud data, rather than just the few files they intended to share.

How OAuth Works—and How It Fails Here​

OAuth 2.0 forms the backbone of authentication for thousands of modern web apps. It is supposed to allow precise control over what actions an integrated app can take—read-only access to a document, view a contact list, or just upload a single file. However, as reported by TechRadar and The Hacker News, Microsoft's implementation via OneDrive File Picker does not implement sufficiently fine-grained OAuth scopes. Instead, the available permissions (“scopes”) are limited to settings like files.read.all, which as the name suggests, gives apps the ability to read all files.
According to a statement by the Oasis research team:

"This stems from overly broad OAuth scopes and misleading consent screens that fail to clearly explain the extent of access being granted... The lack of fine-grained scopes makes it impossible for users to distinguish between malicious apps that target all files and legitimate apps that ask for excessive permissions simply because there is no other secure option."

The ramifications of this extend far beyond user confusion. Attackers exploiting this flaw could potentially use the gained access for data theft, ransomware attacks, corporate espionage, or even targeted phishing. For organizations bound by regulations such as GDPR, HIPAA, or CCPA, such leaks could also result in serious legal and financial consequences.

Third-Party App Ecosystem: A Double-Edged Sword​

The vulnerability takes on much greater significance given how widely OneDrive is embedded in productivity and collaboration workflows. Microsoft’s cloud storage is integrated with numerous high-profile platforms including ChatGPT, Trello, Slack, and other cloud collaboration tools. Whenever one of these apps connects to OneDrive via the File Picker, it receives the same set of excessive permissions. Oasis Security notes that it is not just malicious applications that could abuse this; many legitimate apps request more privilege than they actually need, simply because Microsoft’s restricted scope options leave them no alternative.
This all-or-nothing approach to permissions is both a symptom and a cause of broader issues in cloud ecosystem design: vendors want to offer rich APIs, but security—and especially the principle of least privilege—lags behind feature development.

Risk Amplifiers: Insecure Token Storage​

If the risk of excessive permissions wasn’t enough, Oasis Security highlighted another disturbing detail: how OAuth access tokens, which serve as the keys to the kingdom, are stored. Their findings indicate that these tokens are often saved in browser session storage in plaintext form. Should a malicious script, extension, or man-in-the-browser attack gain access, it could harvest these tokens and replay them, granting attackers unfettered entry to the victim’s cloud data without needing to compromise passwords or break encryption.
While session storage is generally less persistent than cookies or local storage, the storage of high-value authentication assets in an unsecured, plaintext form inside the browser remains a best-practices violation. If an attacker manages to inject code into a browser tab by any means—XSS, for instance—these tokens are ripe for the taking.

Microsoft's Response: Acknowledgment, But No Immediate Fix​

Perhaps most troubling is that, according to the reporting from TechRadar and other outlets, Microsoft has acknowledged the issue but has yet to issue a patch or offer meaningful mitigation. This leaves millions of users in limbo, forced to either accept the risk or, as Oasis suggests, disable OneDrive integration with third-party apps that use OAuth until a fix arrives.
This is not the first time Microsoft’s cloud authentication practices have come under fire. In 2023, security researchers at Proofpoint revealed similar issues regarding excessive permissions in Microsoft Graph, a broader set of APIs for accessing data in Microsoft 365. The recurring theme is the friction between ease of integration and robust security, with users left to bear the consequences.

Broader Security and Compliance Implications​

While individual users may suffer data theft or privacy invasions if this flaw is exploited, the stakes are often much higher for organizations. Many enterprises utilize OneDrive to store confidential documents, intellectual property, and regulated personal information. If a compromised OAuth token or excessive third-party permissions leads to the exposure of this data, the resulting data breach could trigger costly litigation, fines, loss of customer trust, and even regulatory investigations.
For industries governed by ISO, SOC2, or regional privacy frameworks, ensuring that only the minimum necessary data is exposed to apps and external actors is a basic tenet of compliance. Microsoft's lack of fine-grained OAuth scopes for OneDrive may make it impossible, as Oasis points out, to offer demonstrable proof that data minimization principles are being upheld.

Best Practices: What Can Users and Admins Do?​

In light of the ongoing risk, security experts recommend several practical steps for organizations and power users:

• Restrict OAuth Integrations: Temporarily disable third-party app access to OneDrive, especially for apps with unclear provenance or limited necessity.
• Token Management: Avoid using fresh or persistent tokens wherever possible. Regularly invalidate tokens and ensure that applications are not persistently storing credentials in any browser-based storage.
• Review App Permissions: Conduct an immediate audit of all apps with access to OneDrive via OAuth, and revoke permissions for any that are not absolutely essential.
• User Education: Train users to closely review the permissions being requested by apps and discourage the habit of blindly approving OAuth consent screens.
• Advanced Monitoring: Leverage Microsoft 365 and third-party security dashboards to actively monitor for new app consent events, anomalous sharing patterns, or suspicious downloads.
• Push for Change: Organizations with enterprise agreements should urge Microsoft (or their account managers) to provide a timeline for granular permission controls and to strengthen documentation on OAuth risks.

Critical Analysis: Where Microsoft Falls Short​

Microsoft’s cloud platforms have long been lauded for their rich ecosystems and tight integration. In the rush to offer maximum flexibility and developer convenience, however, the company appears to have deprioritized the principle of least privilege—a core tenet in modern cybersecurity frameworks.
The absence of fine-grained OAuth scopes isn’t just a technical shortcoming; it signals a gap in threat modeling and user-centric design. While it is certainly easier for Microsoft and app developers to maintain broad, monolithic scopes (since it reduces the number of code paths and edge cases to handle), this choice runs counter to both industry best practices and the expectations of business customers operating in high-risk or regulated environments.
For years, vendors and the security community have recognized that overly broad API scopes are a leading cause of permission creep and unintended data exposure. Google Drive, Dropbox, and Box have all made efforts in recent years to allow more granular consent and to clarify scope requests in their interfaces; Microsoft's lag on this front, especially given the scale of its enterprise customer base, is hard to justify.

The Bigger Picture: Trust in Cloud Software and the Zero Trust Paradigm​

Cloud services have won the global productivity war by abstracting away the headaches of hardware and location. However, “cloud” is another way to say “other people’s computers”—and with anything you store in the cloud, security is only as strong as the permissions you grant and the audit controls you enforce.
The “zero trust” security model, highly recommended by security experts, dictates that no integration—no matter how well-branded or seemingly benign—should be inherently trusted. Every request, every action, and every access token should be subject to continuous scrutiny and, ideally, strict segmentation. The current reality of OneDrive File Picker’s implementation appears fundamentally at odds with this philosophy. When users or admins cannot restrict an app to only the files or folders necessary, the entire zero trust approach breaks down.

Industry and Community Response​

Members of the broader cybersecurity community have called for both immediate and systematic changes in how OAuth permissions are implemented across the industry—but especially at Microsoft, given its influence and the sheer number of people relying on its services. On forums, industry blogs, and at recent security conferences, experts are urging Microsoft to:

• Introduce scope segmentation at the folder or document level.
• Overhaul consent screens to make permissions explicit, in plain language.
• Force token storage in secure, encrypted containers, even for browser-based use cases.

There is also pressure on regulators, especially those in the EU and North America, to update cloud compliance norms to specifically address OAuth scope granularity and token management.

Looking Ahead: The Road to a More Secure OneDrive​

Microsoft’s current acknowledgment of the issue is a start, but it is not enough. The company’s vast developer relations resources should be marshaled to educate partners about minimum necessary privilege, and engineering teams must prioritize a fix that aligns OneDrive’s permission model with the modern reality of cloud security threats.
If Microsoft fails to act, or if the fix takes months or years, the likelihood is high that attackers will weaponize the excessive scopes in targeted or even automated attacks. The result could be more high-profile breaches, greater financial loss for affected organizations, and renewed calls for stricter oversight of major cloud vendors.
Conversely, if Microsoft moves swiftly, offering granular permission scopes and secure token practices by default, it could set a new bar for the industry. This would not only restore lost trust, but also position the company’s cloud ecosystem as the most secure option for both end-users and compliance-conscious organizations worldwide.

Conclusion: Key Takeaways for Windows and OneDrive Users​

The exposure of this OneDrive File Picker flaw is a clarion call to users, developers, and cloud providers alike: the march of integration and convenience must not come at the expense of privacy and security. While OneDrive’s extensive ecosystem delivers real value, it is only as safe as the permissions and controls that underpin it.
Until Microsoft delivers an official fix, users are urged to exercise caution, restrict app access, carefully review OAuth consent screens, and stay informed about emerging best practices in cloud security. Enterprises, in particular, should engage with Microsoft for updates and apply rigorous audit trails to their cloud integrations.
Microsoft’s handling of this disclosure—and its response in the coming weeks—will be a litmus test for its broader commitment to secure, user-centric cloud computing. The world is watching, and so are the attackers. Those who value their data’s privacy would be wise not to wait for the patch, but to act defensively now.

---

Source: TechRadar A key Microsoft OneDrive feature has a worrying security flaw which could expose user data