Active debug code present in SFM Software Technologies Inc.’s Costifier can reveal internal logs and configuration data when non‑production interfaces are accessed. The vulnerability is classified as CWE‑489, indicating an inadvertent release of debug information that may aid an attacker in reconnaissance or further intrusion. The supplied vendor information does not state that debug mode is actively enabled, but the presence of debug code itself constitutes a potential lever for disclosure.

The affected product is SFM Software Technologies Inc.’s Costifier. The issue is documented to affect all released versions up through 2026‑10‑16. No specific version ranges or patch details are provided, and no other vendors are involved.

A CVSS score of 5.3 points to moderate risk, and the EPSS score of < 1% indicates a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploitation in the wild. Based on the description, it is inferred that exploitation may involve access to non‑production interfaces, but the CVE data does not specify the required attack vector, privilege level, or environmental conditions for exploitation.