CVE-2025-62180 is an authorization bypass vulnerability in Pegasystems Pega Infinity version 8.3.0. The weakness lies in improper authorization controls that allow authenticated users to access data beyond their intended permissions by manipulating user-controlled keys in URLs. This vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required beyond authenticated user, no user interaction, and high impact on confidentiality with limited impact on availability and integrity. No vendor advisory or patch is currently available.

An authenticated user could exploit this vulnerability to bypass authorization controls and access additional sensitive data that should be restricted. This could lead to unauthorized disclosure of information within the affected Pega Infinity environment. There is no indication of impact on system availability or integrity beyond the data exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround has been published, organizations should monitor for updates from Pegasystems and consider restricting access to affected versions where possible until a patch is available.