Active debug code in SFM Software Technologies Inc.’s Costifier can expose internal logs and configuration data through non‑production interfaces. While the CVE description does not confirm that debug mode is currently enabled, the presence of debug code alone is a potential lever for an attacker to retrieve sensitive information if such code is exercised. The weakness is classified as CWE‑489, which addresses the inadvertent release of debug information that can assist attackers in reconnaissance or further intrusion.

The affected product is SFM Software Technologies Inc.’s Costifier. The issue is present in all versions up to the release date of 2026‑10‑16. No specific version ranges are specified in the advisory, and no other vendors are involved.

A CVSS score of 5.3 indicates moderate risk and is not currently listed in the CISA KEV catalog, which suggests no confirmed exploitation in the wild. Exploitation would likely require network access to the production environment and identification of the debug endpoint; it does not require elevated privileges. If the active debug code is exercised, attackers could obtain confidential system data via the non‑production interface, potentially aiding further malicious activity.