Ikas E-Commerce Infrastructure EUVD-2026-102819

No special configuration is required: per AV:N/AC:L/PR:N/UI:N the flaw is remotely exploitable by unauthenticated attackers against the default deployment of ikas E-Commerce Infrastructure (versions through 2026-07-13), by interacting with publicly exposed authentication-related endpoints (login, registration, or password reset) that return distinguishable responses for valid versus invalid accounts. The main limiting factor is impact scope rather than access: exploitation only reveals whether an account exists, so its value depends on the attacker having or acquiring a candidate list of identifiers and on follow-on attacks (credential stuffing, phishing) to convert enumeration into actual compromise.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 7.5 HIGH) describes a remotely reachable, low-complexity, unauthenticated flaw with no user interaction, which on paper is attractive to attackers. However, the vulnerability class (CWE-204, Observable Response Discrepancy) and the stated impact ('Account Footprinting') point to username/account enumeration rather than disclosure of sensitive content, so the C:H (high confidentiality) rating appears inflated - enumeration of account existence is typically a LOW confidentiality impact, which would drop the realistic base score to around 5.3. This is the key conflict: the scored severity is HIGH, but the actual technical impact is reconnaissance-grade information disclosure, not direct compromise. There is no CISA KEV listing, no POC referenced, and no EPSS value supplied, so there is no evidence of active or imminent exploitation; the practical priority is MEDIUM at most. Account footprinting is a useful precursor to credential-stuffing or phishing but is not an end-state compromise on its own, so treat this as a hardening/defense-in-depth item rather than an emergency patch.

An unauthenticated attacker sends crafted login, registration, or password-reset requests to the ikas E-Commerce platform and observes measurable differences in the responses (wording, status, or timing) between existing and non-existing accounts. By iterating over a list of email addresses, the attacker builds a confirmed list of valid merchant/customer accounts to feed into subsequent credential-stuffing or targeted phishing. No public exploit code is referenced, but the technique is trivial to script given the network-reachable, low-complexity vector.