services / Azure / Azure SQL Managed Instance database query (Query Store)

A Query Store query record on an Azure SQL Managed Instance database, exposing the stored SQL query text for a given query id.

Query text can embed schema, table/column names, business logic, and literal parameter values from a production database.

Microsoft.​Sql/​managedInstances/​databases/​queries/​read

Retrieves the stored SQL query TEXT by id from Query Store, which can leak literal data values and reveal database schema/structure beyond mere enumeration.

Risks

1. Data exfiltration (CRITICAL)
2. Data discovery (LOW)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links