CVE-2021-40457: Microsoft Dynamics 365 Customer Engagement Cross-Site Scripting Vulnerability

The CVSS Score says user action is required. What type of user action is required?

A user would have to open a maliciously crafted email sent to Dynamics 365 Customer Engagement.