The vulnerability exists in the Shopware Commercial platform where the /api/_info/config endpoint discloses licensing information, allowing an attacker to read sensitive license data. The primary impact is a confidentiality breach of licensing credentials, which could be leveraged to assess the system's licensing status or potentially expose proprietary activation secrets. The weakness is classified as CWE-200, Information Exposure.

Shopware Commercial installations running a version earlier than 7.8.1 for branch 7 or earlier than 6.10.15 for branch 6 are affected. The CVE notes that the issue is fixed in 7.8.1 and 6.10.15; any version not matching those releases should be considered vulnerable.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is below 1%, signifying a low likelihood of active exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw remotely by accessing the publicly reachable /api/_info/config endpoint, likely without authentication, but the exact prerequisites are not detailed in the description. Since the API endpoint returns licensing data regardless of user context, an unauthenticated request can succeed, making the attack straightforward once the target system is identified.