The vulnerability is an authorization flaw—specifically a missing or incorrect authorization check—that allows a user who has logged into the frontend to access backend application interfaces. This can lead to unauthorized execution of sensitive backend operations that may compromise the confidentiality, integrity, and availability of the system. The weakness is best described as CWE‑284, Improper Authorization.

The issue affects the Innoshop e‑commerce platform, version 0.6.0. No other products or versions are listed as impacted. The vendor is Innoshop; the specific affected version is 0.6.0.

The CVSS score is 7.3, indicating a high severity risk. The EPSS score of <1% indicates a very low but nonzero exploitation probability, and the flaw is not listed in the CISA KEV catalog, indicating that publicly known exploitation is currently low or none. The likely attack vector is through a legitimate user login to the frontend, after which the attacker can request backend endpoints that bypass proper authorization checks; this inference is based on the stated requirement that an attacker must be logged in. An attacker does not need elevated privileges beyond those used to login, but the vulnerability permits the use of backend functions normally reserved for administrators. Because no exploit code has been documented, the risk remains theoretical until the vendor releases a fix.