iKAS E-Commerce CVE-2026-7488

Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation requires no authentication, no user interaction, and only network reachability to the affected iKAS E-Commerce application running any version through build 03062026 - effectively no special conditions against default deployments. The concrete prerequisite is the presence of the specific response/endpoint that embeds the sensitive data (CWE-201); the attacker must reach and query that endpoint over the network. Limiting factors: the impact is confined to confidentiality (I:N/A:N), so the attacker only reads data and cannot modify or disrupt the system; realistic risk also depends on the sensitivity of the specific fields leaked, which the generic description does not enumerate. The product's niche regional footprint further limits the population of exploitable targets.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5 High) describes a purely confidentiality-impacting flaw: network-reachable, low complexity, no privileges, no user interaction, high confidentiality loss with no integrity or availability impact - a classic unauthenticated data-exposure pattern. However, several corroborating signals are missing: no EPSS score, no SSVC decision data, no KEV listing, and no POC were provided, so exploitation probability cannot be quantified and remains inferred solely from the CVSS vector. The high CVSS is driven entirely by ease of access plus C:H, which is credible for an information-disclosure bug, but real-world priority depends on how sensitive the exposed data actually is (the description is generic). Because the product is a niche regional platform rather than ubiquitous software, this is likely a targeted rather than mass-exploitation risk. Treat as a genuine but moderate priority pending confirmation of exactly what data is disclosed.

A remote attacker with no credentials sends ordinary HTTP requests to the iKAS storefront or its API and observes that the responses embed sensitive information the attacker should not see. By systematically collecting these responses, the attacker harvests confidential data at scale without authentication or user interaction. No public POC is currently known, so exploitation would require independent discovery of the leaking endpoint.