Shopware’s Store API login endpoint (POST /store-api/account/login) returns distinct error codes that reveal whether an entered email address belongs to a registered customer; additionally, the "CHECKOUT__CUSTOMER_NOT_FOUND" response echoes the probed email address. This flaw allows an unauthenticated attacker to enumerate valid customer accounts, exposing customer data and potentially facilitating targeted attacks. The vulnerability is a classic example of CWE‑204 (Information Exposure – Sensitive Data Leakage).

The flaw affects Shopware core and platform products, specifically any installations running versions earlier than 6.7.8.1 or 6.6.10.15. These affected products are listed under the CNA vendors/shopware:core and shopware:platform, with the CPES string cpe:2.3:a:shopware:shopware:*:*:*:*:*:*:*:* covering the product family.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests low current exploit probability; the vulnerability is not cataloged in CISA’s KEV. Exploitation requires no authentication, and an attacker can simply send repeated login attempts to the Store API endpoint, gleaning valid email addresses from the differing error codes. Given the ease of use—simple HTTP requests—and the low resources required, the risk to affected systems is tangible if the platform handles sensitive customer data. Prompt patching mitigates this exposure.