Technical impact
The vulnerability arises from a flaw in the authentication middleware that processes the plugin safe mode toggle on the admin logout route before confirming user authentication. This reflects a CWE‑306 weakness: Authentication Bypass via Privilege Escalation, allowing an unauthenticated remote attacker to send a single request to enable or disable safe mode. When enabled, all installed plugins—including payment and shipping integrations—are deactivated, resulting in a shop‑wide denial of service.
Affected Systems
The affected product is JTL‑Software GmbH’s JTL‑Shop e‑commerce platform. The CVE notes that manual patches will be issued for older unsupported versions, specifically 5.4.x and 5.5.x. No additional version details are supplied, so the vulnerability may exist in those and potentially other recent releases until remedied.
Risk and Exploitability
The CVSS score is 8.7, indicating high severity, while the EPSS score of 0.00531 shows a low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires only one crafted HTTP request and can be automated across multiple sites. Based on the description, the likely attack vector is remote HTTP access to the admin logout endpoint; the attacker does not need any prior credentials. Given the high severity and low exploitation probability, organizations should treat this as a serious risk for affected installations, especially those still running unsupported versions.
