End Of The World As We Know It: Security Leaks In Power Pages
From CRM Audio by George Doubinski
August 17, 2025 · 34 min · Season 3 · Episode 4
About this episode
This episode explores the history of security issues in Power Pages, discussing misconfigurations, vulnerabilities, and the comparison with other platforms.
In this episode, we take a close look at the history of security issues in Power Pages. We start with the early days — when simple misconfigurations like unchecked table permissions and enabled OData feeds led to major data exposures. These weren't bugs, but they showed how easy it was to set things up the wrong way. We talk about how Microsoft responded and what lessons we've learned about secure defaults and clear documentation. We then move on to more serious vulnerabilities introduced by newer features like the Web API. We explain how some of these flaws allowed access to restricted data using filters and sort clauses, and how those issues were eventually patched. These were real product-level bugs, and some were even exploited in the wild. We also share our thoughts on external authentication providers like Google, and the risks that come with delegating authentication — including phishing techniques that can bypass protections. Finally, we reflect on how Power Pages compares to platforms like WordPress, especially when it comes to architecture and the potential for plugin-related vulnerabilities. Despite recent issues, we think the original design of Power Pages deserves…
People in this episode
Host: George Doubinski
Topics covered
- security
- Power Pages
- data exposure
- authentication
- vulnerabilities
Keywords
- security issues
- data exposures
- OData feeds
- Web API
- external authentication
- phishing techniques
- plugin-related vulnerabilities
Mentioned in this episode
Products: Power Pages, Power Apps, Power Platform, Microsoft, WordPress
Books & works: End Of The World As We Know It:
More episodes of CRM Audio
- jQuery or Not, Client-Side API Will Always Start with a $ · April 4, 2026 · 22 min
- Hide your dirty laundry on the server-side · January 22, 2026 · 28 min
- Contacts Are Users Too - Now with Dataverse Privileges · October 6, 2025 · 19 min
- Hidden In Plain Site: Underused Features in Power Pages · July 17, 2025 · 50 min
- Cache Me If You Can: The Power Pages Wishlist · May 31, 2025 · 31 min
- What's Really Coming in Release Wave 1 2025: AI Hype And A New Security Threat · March 10, 2025 · 37 min
Explore listener stats, chart rankings, contacts and more on the CRM Audio podcast page.