{"id":"CVE-2026-111668","kind":"vulnerability","aliases":["CVE-2026-111668"],"related":[],"title":"AIHelms: missing authorization lets low-privilege users read AI spend","description":"AIHelms through 0.1.25 contains a missing authorization vulnerability in apps/api/v1/efficiency.py that allows authenticated low-privileged users to bypass efficiency:read and efficiency:write permission checks. Attackers can query routes like /cost/detail, /top-users and /budget to read organization-wide AI spend, and can modify suggestion statuses or generate reports.","summary":"AIHelms through 0.1.25 has a missing authorization check in apps/api/v1/efficiency.py that skips the efficiency:read and efficiency:write permission checks. An authenticated low-privileged user can read organization-wide AI spend through /cost/detail, /top-users and /budget, and can change suggestion statuses or generate reports.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"AIHelms","fixed":[],"affected":">= 0, <= 0.1.25","ecosystem":"github"}],"ecosystems":[],"tags":["ai-spend-tracking","ai-tooling","aihelms","authenticated","missing-authorization","self-hosted"],"not_affected_if":["auth-required","no-untrusted-users","single-user-deployment"],"how_to_check":"- Check whether AIHelms is 0.1.25 or earlier (latest tag seen is 0.1.25; no fixed release found).\n- In apps/api/v1/efficiency.py, read routes (/cost, /cost/detail, /cost/detail/scope-users, /top-users, /budget, /adoption/*, /reports) should use Depends(require_permission(\"efficiency:read\")); in 0.1.25 they use only Depends(get_current_user). PUT /efficiency/suggestions/{id}/status is also get_current_user only.\n- Test: with a non-admin token lacking efficiency:read, GET /api/v1/efficiency/top-users; HTTP 200 means exposed, 403 means gated.","fix":"No fixed version published as of 2026-10-25 (0.1.25 is the latest tag). Until then: restrict network access to the API, limit accounts to trusted users, or add Depends(require_permission(\"efficiency:read\")) to read routes and efficiency:write to the suggestion status route yourself. Watch github.com/beizhu-1209/AIHelms for a release after 0.1.25.","status":"open","published_at":"2026-10-16T18:17:48+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T04:18:21+00:00","updated_at":"2026-10-25T04:19:23+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-25T04:18:21Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"AIHelms: missing authorization lets low-privilege users read AI spend","impact":"medium","summary":"AIHelms through 0.1.25 has a missing authorization check in apps/api/v1/efficiency.py that skips the efficiency:read and efficiency:write permission checks. An authenticated low-privileged user can read organization-wide AI spend through /cost/detail, /top-users and /budget, and can change suggestion statuses or generate reports.","category":"ai-tooling","nicknames":[],"who_cares":["aihelms","self-hosted","ai-spend-tracking"],"confidence":0.6,"needs_auth":"yes","worst_case":"Low-privilege user reads org-wide AI spend and alters suggestion statuses.","analyst_note":"Find the fixed AIHelms version and confirm the exact permission decorators in apps/api/v1/efficiency.py via the NVD entry or upstream repository.","how_to_check":"- Check whether the deployed AIHelms version is `0.1.25` or earlier.\n- Look at apps/api/v1/efficiency.py for the permission decorators on the /cost/detail, /top-users and /budget routes.\n- Test with a low-privilege account: request `/cost/detail` and confirm whether it returns organization-wide data.","needs_analyst":true,"not_affected_if":["single-user-deployment","auth-required"],"who_is_affected":"Teams running AIHelms 0.1.25 or earlier where ordinary authenticated accounts exist alongside finance or admin roles. Deployments with only a single trusted user are at lower risk. The sources do not say which versions fix this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00064,"input_tokens":3354,"output_tokens":609,"severity_before":"medium"},"analyst_status":"done","analyst_note":"Find the fixed AIHelms version and confirm the exact permission decorators in apps/api/v1/efficiency.py via the NVD entry or upstream repository.","search":"'-111668':14A,17A '-2026':13A,16A '/budget':71B,114C '/cost/detail':68B,111C '/top-users':69B,112C '0.1.25':36B,82C 'ai':10A,20B,24B,65B,120C 'ai-spend-track':19B 'ai-tool':23B 'aihelm':1A,26B,34B,80C 'aihelms':18A 'allow':91C 'apps/api/v1/efficiency.py':43B,89C 'attack':106C 'authent':27B,55B,92C 'author':3A,30B,40B,86C 'bypass':98C 'chang':74B 'check':41B,53B,105C 'contain':83C 'cve':12A,15A 'effici':47B,50B,99C,102C 'generat':78B,128C 'host':33B 'let':4A 'like':110C 'low':6A,57B,94C 'low-privileg':5A,56B,93C 'miss':2A,29B,39B,85C 'missing-author':28B 'modifi':124C 'organ':63B,118C 'organization-wid':62B,117C 'permiss':52B,104C 'privileg':7A,58B,95C 'queri':108C 'read':9A,48B,61B,100C,116C 'report':79B,129C 'rout':109C 'self':32B 'self-host':31B 'skip':45B 'spend':11A,21B,66B,121C 'status':76B,126C 'suggest':75B,125C 'tool':25B 'track':22B 'user':8A,59B,96C 'vulner':87C 'wide':64B,119C 'write':51B,103C","nicknames":[],"mitigations":[],"who_affected":"Teams running AIHelms 0.1.25 or earlier where ordinary authenticated accounts exist alongside finance or admin roles. Deployments with only a single trusted user are at lower risk. The sources do not say which versions fix this.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:48+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111668","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111668","severity":null,"published_at":"2026-10-16T18:17:48+00:00","modified_at":"2026-10-23T15:17:24+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111668:811","url":null,"severity":null,"published_at":"2026-10-25T04:19:23+00:00","modified_at":"2026-10-25T04:19:23+00:00","first_seen_at":"2026-10-25T04:19:23+00:00","fetched_at":"2026-10-25T04:19:23+00:00","note":"Read reporter writeup (hackmd) and 0.1.25 source: all efficiency read routes use only Depends(get_current_user); only POST /refresh uses require_permission('efficiency:write'); PUT /suggestions/{id}/status also ungated. Triage's claim that efficiency:write checks are skipped for report generation is not confirmed by the writeup (only suggestion status). No fixed version: tags page shows 0.1.25 (Sep 26 2026) as latest, no vendor advisory. Writeup is static analysis, not executed; no exploitation or public PoC code seen. Nothing marked verified (no vendor statement)."}],"documents":[{"id":3389,"url":"https://hackmd.io/@hieuPenguinnn/aihelms-efficiency-analytics-missing-authorization","title":"AIHelms efficiency analytics missing authorization (reporter writeup)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3390,"url":"https://github.com/beizhu-1209/AIHelms/blob/0.1.25/apps/api/v1/efficiency.py","title":"AIHelms 0.1.25 apps/api/v1/efficiency.py","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":3391,"url":"https://www.vulncheck.com/advisories/aihelms-through-0.1.25-missing-authorization-in-efficiency-analytics-api","title":"VulnCheck: AIHelms through 0.1.25 missing authorization","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}