The vulnerability allows an authenticated user with limited permissions to delete project groups within PowerSYSTEM Center, an action that the user should not be able to perform; this represents a breach of the correct authorization controls (CWE‑863). The impact is the removal of configuration items and associated data that may be critical to network operations, potentially causing data loss and disrupting service availability for authorized users.

Affected products are Subnet Solutions PowerSYSTEM Center 2024 and PowerSYSTEM Center 2026; specific version numbers are not listed in the advisory, so any instance of these releases is potentially vulnerable.

The CVSS score of 7 indicates moderate to high severity. The exploit requires a valid account with limited permissions, so the attack vector is an authenticated local or network user; no remote code execution is involved. Since EPSS is not available and the vulnerability is not listed in CISA KEV, the expected exploitation likelihood is moderate, but the potential impact on data integrity and availability remains significant.