CVE-2026-26289
Subnet Solutions PowerSYSTEM Center Incorrect Authorization
- State
- Published
- Severity
- 8.4 High
- Published
- May 12, 2026
- Updated
- May 13, 2026
- Reserved
- Apr 16, 2026
Description
PowerSYSTEM Center REST API endpoint for device account export allows an authenticated user with limited permissions to expose sensitive information normally restricted to administrative permissions only.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.4 High | CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:H/SA:H | icscert |
| 3.1 | 8.2 High | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L | icscert |
Weaknesses
- CWE-863 Incorrect Authorization
Affected Products
| Product | Versions |
|---|---|
PowerSYSTEM Center 2020Subnet Solutions |
|
PowerSYSTEM Center 2024Subnet Solutions |
|
PowerSYSTEM Center 2026Subnet Solutions |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.