Live › vulnerability › CVE-2026-111681
Go to dashboardEFAK 5.0.0-5.1.0: /api/users is not on the ADMIN list in WebSecurityConfig, and UserController takes roles from the request body. Any logged-in account, including default ROLE_USER, can promote itself to ROLE_ADMIN, create admins or delete users, and so control the managed Kafka clusters. CSRF is also disabled. No patched version has been published.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| EFAK | github | >= 5.0.0, <= 5.1.0 | – |
5.0.0 to 5.1.0 is affected)No fixed version as of 2026-10-24. Restrict network access to EFAK, audit admin accounts, and rotate the provider API keys stored in EFAK (see CVE-2026-111682). Local patch per the write-up: add /api/users/, /api/model-config/ and /api/scheduler/** to the hasRole(ADMIN) matcher, add @PreAuthorize to the controllers, and stop trusting roles in the request body. Watch smartloli/EFAK releases for a version after 5.1.0.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage accounts because the /api/users endpoints lack administrator role checks. Attackers can send POST, PUT, or DELETE requests to UserController to grant themselves ROLE_ADMIN, create administrators, or delete users, gaining control of managed Kafka clusters.
This page as .md · .json · in your agent: get_signal("CVE-2026-111681")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.