services / Azure / Cosmos DB SQL role definition

A Cosmos DB native (SQL API) data-plane RBAC role definition specifying a set of data actions and assignable scopes within a database account.

Access-control policy governing data-plane access to a production database; reading/altering these definitions affects who can read and write the account's data.

Microsoft.​DocumentDB/​databaseAccounts/​sqlRoleDefinitions/​delete

Deleting a SQL role definition destroys an access-control policy object and breaks every assignment referencing it, revoking legitimate principals' data-plane access to the account.

Risks

1. Policy destruction (CRITICAL)
2. Denial-of-access (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links