The vulnerability is in the PowerSYSTEM Center REST API endpoint that exports device account information. An authenticated user with limited permissions is able to invoke this endpoint and retrieve sensitive data that should normally be restricted to administrators. This incorrect authorization allows an attacker to read privileged account details, potentially exposing credentials, configuration data, or other sensitive information. The weakness is categorized as CWE‑863: Improper Authorization.

Subnet Solutions PowerSYSTEM Center 2020, 2024, and 2026. The issue affects the product releases identified as PSC 2020, PSC 2024, and PSC 2026. Exact patch level details are listed in the vendor solution document: PSC 2020 Update 29, PSC 2024 Update 2, and PSC 2026 GA Hotfix.

The CVSS score of 8.4 classifies the flaw as high severity, indicating significant impact if exploited. EPSS data is not available, but the vulnerability requires only an authenticated user with non‑administrative rights, which many organizations grant. It is not currently listed in CISA’s KEV database. The most likely attack vector involves an internal user or compromised account exploiting the export endpoint to gather sensitive information. While no public exploits are known, the flaw can be leveraged to compromise confidentiality by exposing account credentials and related data.