The vulnerability allows an attacker to retrieve configuration details via the /api/_info/config route, exposing information about active security fixes and licenses. This information disclosure can aid an adversary in planning further attacks or identifying which security updates have been applied to the system. The weakness is classified as CWE-200, a misuse of information security controls that leads to the unintended release of sensitive data.

The affected product is Shopware’s platform-security component, known as swag:platform-security. Versions before 2.0.16, 3.0.12, and 4.0.7 are impacted, as noted in the vendor’s advisory that the issue is fixed in these releases.

The CVSS score of 5.3 indicates medium severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers would need network access to the server to call the exposed API endpoint; no authentication is required to retrieve the data. The exposure permits only information gathering and does not provide an immediate execution or privilege escalation path.