This vulnerability (CWE-863) in PowerSYSTEM Center 2020 affects the REST API endpoint for devices, where authorization controls are improperly enforced. As a result, authenticated users with low privileges can retrieve information that normally requires higher operational permissions. The CVSS 4.0 base score is 6.9 (medium severity), reflecting the potential impact of unauthorized information disclosure without requiring user interaction. The vulnerability affects version 5.11.x of the product. There is no indication of known exploits in the wild or an official fix at this time.

An attacker with low privilege authenticated access can bypass intended authorization restrictions to access sensitive information via the REST API. This could lead to unauthorized disclosure of operational data that should be protected. The vulnerability does not allow privilege escalation, code execution, or denial of service based on the available data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the REST API to trusted users only and monitor for unusual access patterns. Avoid granting unnecessary privileges to users to limit potential exposure.