Isotope eCommerce EUVD-2026-85341

Requires an authenticated Contao backend session belonging to a user who has been granted Isotope module permissions; the attacker must reach the Isotope backend callbacks (Attribute, ProductPrice, or MediaManager) that interpolate request-controlled identifiers and administrator-supplied values into SQL. Limiting factors: no unauthenticated or anonymous path exists (PR:H), exploitation is blind (conditional/time-based), and it is confined to Isotope eCommerce installations at or below version 2.9.10 running on Contao. No end-user interaction is required (UI:N).

This is a genuine but access-gated vulnerability, not a mass-exploitation threat. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N, base 7.0) is internally consistent with the description: network-reachable backend, low complexity, but requiring PR:H - an authenticated Contao backend user who additionally holds Isotope module permissions. That high-privilege prerequisite is the dominant risk-limiting factor. The primary impact is confidentiality (VC:H): extraction of arbitrary database contents including tl_user password hashes, which enables offline cracking and potential escalation toward full CMS compromise. No EPSS score, no CISA KEV listing, and no explicit proof-of-concept exploit code are present in the provided data - only a VulnCheck advisory and GitHub issue/source references. Signals are consistent rather than conflicting: high-CVSS is justified by the sensitive data exposed, but real-world risk is tempered because the attacker must already be a privileged, trusted backend operator. Treat this as an insider/lateral-movement and post-compromise-escalation concern rather than an internet-facing unauthenticated emergency.

An authenticated Contao backend user with Isotope module permissions (e.g., a low-trust store manager or a compromised backend account) manipulates request-controlled identifiers or attribute/price callback values so that crafted input is interpolated directly into SQL. Using conditional and time-based blind payloads, they iteratively extract tl_user administrator password hashes and other database contents. No public exploit code is identified in the provided data, though the VulnCheck advisory and GitHub issue #2585 document the vulnerable callback code paths.