Exposure of sensitive information to an unauthorized actor in Power Automate allows an authorized attacker to disclose information over a network.
What type of information could be disclosed by this vulnerability? This vulnerability could expose values stored in variables that were marked as “Sensitive” within Power Automate Desktop flows. Due to a logging issue, these sensitive variable values may appear in execution logs uploaded to the Power Automate portal and be viewable by users with Owner, Co-Owner, or Runner permissions for the affected desktop flow.
Ioannis Panagiotopoulos with Microsoft