E-Commerce Pack CVE-2026-11795

Exploitation requires a network-reachable E-Commerce Pack instance exposing an authentication-related function (login, account registration, or password recovery) that returns observably different responses for valid versus invalid accounts; no credentials or user interaction are needed (PR:N/UI:N). What limits impact: the flaw only discloses account existence (C:L, no integrity/availability effect), so it yields reconnaissance data rather than direct compromise, and its usefulness depends on the deployment actually fronting a user-account system on the public internet.

This is a low-to-moderate priority information-disclosure issue, not an urgent threat. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3) indicates a remotely reachable, low-complexity, unauthenticated weakness with only limited confidentiality impact and no integrity or availability impact - consistent with an account/username enumeration (observable discrepancy, CWE-203) rather than a data breach or code execution flaw. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided, so there is no public exploit identified at time of analysis and no evidence of active or automatable exploitation. The practical danger is that enumeration is a reconnaissance primitive that aids follow-on credential-stuffing or phishing against confirmed accounts, so the real risk is amplified only when chained with other attacks. Note the vendor was contacted but did not respond, meaning no patch or fixed version is confirmed; defenders should treat 'through 2026-10-02' as the only version boundary available and verify independently.

A remote, unauthenticated attacker interacts with a public-facing E-Commerce Pack endpoint (such as login, registration, or password-reset) and observes differing responses, timing, or error messages for existing versus non-existent accounts. By scripting many requests, the attacker builds a list of valid customer accounts to feed into credential-stuffing or targeted phishing. No public exploit code is identified, but the technique requires no special tooling.