---
id: 5825
title: "A New App Consent Attack: Hidden Consent Grant"
source_domain: semperis.com
source_url: "https://www.semperis.com/blog/app-consent-attack-hidden-consent-grant/"
published_at: "2024-08-13T17:41:31Z"
tags: ["cloud", "vulnerability-research", "privilege-escalation", "entra-id", "permissions", "azure-ad", "consent-phishing"]
phying_url: "https://phying.com/item/5825"
lang: en
---

# A New App Consent Attack: Hidden Consent Grant

## Summary

Semperis found Entra ID's Directory.ReadWrite.All permission can be abused to escalate privileges, disrupt services, or take over a tenant—the Hidden Consent Grant attack, rated potentially severe.

## Intelligence Metadata

- **Sources:** semperis.com
- **Published:** 2024-08-13T17:41:31Z
- **Original:** https://www.semperis.com/blog/app-consent-attack-hidden-consent-grant/
- **Phying News:** https://phying.com/item/5825