Unauthenticated attackers can query information about total energy consumed by EV chargers of arbitrary users.
CWE-639