---
id: "CVE-2026-111668"
kind: "vulnerability"
aliases: ["CVE-2026-111668"]
title: "AIHelms: missing authorization lets low-privilege users read AI spend"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "AIHelms", "fixed": [], "affected": ">= 0, <= 0.1.25", "ecosystem": "github"}]
ecosystems: []
tags: ["ai-spend-tracking", "ai-tooling", "aihelms", "authenticated", "missing-authorization", "self-hosted"]
not_affected_if: ["auth-required", "no-untrusted-users", "single-user-deployment"]
published_at: "2026-10-16T18:17:48+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T04:19:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111668", "first_seen_at": "2026-10-23T21:57:13+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T04:19:23+00:00"}]
---

# AIHelms: missing authorization lets low-privilege users read AI spend

AIHelms through 0.1.25 has a missing authorization check in apps/api/v1/efficiency.py that skips the efficiency:read and efficiency:write permission checks. An authenticated low-privileged user can read organization-wide AI spend through /cost/detail, /top-users and /budget, and can change suggestion statuses or generate reports.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:AIHelms affected >= 0, <= 0.1.25 fixed ?

## How to check

- Check whether AIHelms is 0.1.25 or earlier (latest tag seen is 0.1.25; no fixed release found).
- In apps/api/v1/efficiency.py, read routes (/cost, /cost/detail, /cost/detail/scope-users, /top-users, /budget, /adoption/*, /reports) should use Depends(require_permission("efficiency:read")); in 0.1.25 they use only Depends(get_current_user). PUT /efficiency/suggestions/{id}/status is also get_current_user only.
- Test: with a non-admin token lacking efficiency:read, GET /api/v1/efficiency/top-users; HTTP 200 means exposed, 403 means gated.

## Fix

No fixed version published as of 2026-10-25 (0.1.25 is the latest tag). Until then: restrict network access to the API, limit accounts to trusted users, or add Depends(require_permission("efficiency:read")) to read routes and efficiency:write to the suggestion status route yourself. Watch github.com/beizhu-1209/AIHelms for a release after 0.1.25.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111668
- 2026-10-25T04:19:23+00:00 analyst — Read reporter writeup (hackmd) and 0.1.25 source: all efficiency read routes use only Depends(get_current_user); only POST /refresh uses require_permission('efficiency:write'); PUT /suggestions/{id}/status also ungated. Triage's claim that efficiency:write checks are skipped for report generation is not confirmed by the writeup (only suggestion status). No fixed version: tags page shows 0.1.25 (Sep 26 2026) as latest, no vendor advisory. Writeup is static analysis, not executed; no exploitation or public PoC code seen. Nothing marked verified (no vendor statement).

## Documents

- [advisory] AIHelms efficiency analytics missing authorization (reporter writeup) https://hackmd.io/@hieuPenguinnn/aihelms-efficiency-analytics-missing-authorization
- [advisory] VulnCheck: AIHelms through 0.1.25 missing authorization https://www.vulncheck.com/advisories/aihelms-through-0.1.25-missing-authorization-in-efficiency-analytics-api
- [describes] AIHelms 0.1.25 apps/api/v1/efficiency.py https://github.com/beizhu-1209/AIHelms/blob/0.1.25/apps/api/v1/efficiency.py

## From the sources

AIHelms through 0.1.25 contains a missing authorization vulnerability in apps/api/v1/efficiency.py that allows authenticated low-privileged users to bypass efficiency:read and efficiency:write permission checks. Attackers can query routes like /cost/detail, /top-users and /budget to read organization-wide AI spend, and can modify suggestion statuses or generate reports.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_