Live › vulnerability › CVE-2026-111668
Go to dashboardAIHelms through 0.1.25 has a missing authorization check in apps/api/v1/efficiency.py that skips the efficiency:read and efficiency:write permission checks. An authenticated low-privileged user can read organization-wide AI spend through /cost/detail, /top-users and /budget, and can change suggestion statuses or generate reports.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running AIHelms 0.1.25 or earlier where ordinary authenticated accounts exist alongside finance or admin roles. Deployments with only a single trusted user are at lower risk. The sources do not say which versions fix this.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| AIHelms | github | >= 0, <= 0.1.25 | – |
0.1.25 is the latest tag)0.1.25Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
AIHelms through 0.1.25 contains a missing authorization vulnerability in apps/api/v1/efficiency.py that allows authenticated low-privileged users to bypass efficiency:read and efficiency:write permission checks. Attackers can query routes like /cost/detail, /top-users and /budget to read organization-wide AI spend, and can modify suggestion statuses or generate reports.
This page as .md · .json · in your agent: get_signal("CVE-2026-111668")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.