Pega Platform and Pegasystems Pega Infinity versions from 8.3.0 through 25.1.2 contain an authorization weakness that can allow an authenticated user to retrieve additional data by manipulating request URLs. The flaw arises from insufficient authorization checks, enabling disclosure of data to users who lack the necessary permissions and therefore threatens confidentiality. The weakness is reflected in CWE‑639, which describes an authorization bypass through a user‑controlled key.

The vulnerability affects all releases of Pega Platform beginning with 8.3.0 and all releases of Pega Infinity up to and including 25.1.2. End‑points that support URL‑based data retrieval are the primary vectors and thus any installation in this version range is potentially impacted.

The CVSS score of 7.1 reflects a high severity due to the potential for data exposure. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating that public exploits are not known. The attack requires an authenticated session and crafted URLs, so an attacker must first log in and then target specific resources for exploitation. Because the flaw is not dependent on privileged access or remote code execution, the risk primarily lies in unauthorized data access rather than system compromise.