{"id":"CVE-2026-111681","kind":"vulnerability","aliases":["CVE-2026-111681"],"related":[],"title":"EFAK: low-privilege users can grant themselves admin via user API","description":"EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage accounts because the /api/users endpoints lack administrator role checks. Attackers can send POST, PUT, or DELETE requests to UserController to grant themselves ROLE_ADMIN, create administrators, or delete users, gaining control of managed Kafka clusters.","summary":"EFAK 5.0.0-5.1.0: /api/users is not on the ADMIN list in WebSecurityConfig, and UserController takes roles from the request body. Any logged-in account, including default ROLE_USER, can promote itself to ROLE_ADMIN, create admins or delete users, and so control the managed Kafka clusters. CSRF is also disabled. No patched version has been published.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"EFAK","fixed":[],"affected":">= 5.0.0, <= 5.1.0","ecosystem":"github"}],"ecosystems":[],"tags":["efak","kafka","package","privilege-escalation","self-hosted"],"not_affected_if":["auth-required","managed-hosting"],"how_to_check":"Self-hosted EFAK: check the version (5.0.0 to 5.1.0 is affected). Review the user list (the /users page or the user table) for unexpected ROLE_ADMIN accounts. Check that a ROLE_USER session gets 403 on PUT /api/users/{id}; if it succeeds you are exposed. Check access logs for POST/PUT/DELETE on /api/users from non-admin sessions.","fix":"No fixed version as of 2026-10-24. Restrict network access to EFAK, audit admin accounts, and rotate the provider API keys stored in EFAK (see CVE-2026-111682). Local patch per the write-up: add /api/users/**, /api/model-config/** and /api/scheduler/** to the hasRole(ADMIN) matcher, add @PreAuthorize to the controllers, and stop trusting roles in the request body. Watch smartloli/EFAK releases for a version after 5.1.0.","status":"open","published_at":"2026-10-16T18:17:51+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-23T22:33:20+00:00","updated_at":"2026-10-24T00:25:43+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-23T22:33:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"EFAK: low-privilege users can grant themselves admin via user API","impact":"high","summary":"EFAK through 5.1.0 has a missing role check on its /api/users endpoints, so any logged-in user can create, edit, or delete accounts. An attacker can give themselves ROLE_ADMIN and take control of the Kafka clusters EFAK manages.","category":"package","who_cares":["efak","kafka","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"attacker becomes admin and controls managed Kafka clusters","analyst_note":"Check the EFAK project advisory or NVD page for a fixed version and whether low-privilege accounts exist by default.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000459,"input_tokens":2942,"output_tokens":330,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the EFAK project advisory or NVD page for a fixed version and whether low-privilege accounts exist by default.","search":"'-111681':15A,18A '-2026':14A,17A '/api/users':32B,106C '5.0.0':30B '5.1.0':31B,88C 'account':53B,103C 'admin':9A,37B,63B,65B,126C 'administr':109C,128C 'allow':95C 'also':78B 'api':12A 'attack':112C 'authent':96C 'author':92C 'bodi':48B 'check':111C 'cluster':75B,137C 'contain':89C 'control':71B,133C 'creat':64B,127C 'csrf':76B 'cve':13A,16A 'default':55B 'delet':67B,118C,130C 'disabl':79B 'efak':1A,19A,20B,29B,86C 'endpoint':107C 'escal':25B 'gain':132C 'grant':7A,123C 'host':28B 'includ':54B 'kafka':21B,74B,136C 'lack':108C 'list':38B 'log':51B 'logged-in':50B 'low':3A,98C 'low-privileg':2A,97C 'manag':73B,102C,135C 'miss':91C 'packag':22B 'patch':81B 'post':115C 'privileg':4A,24B,99C 'privilege-escal':23B 'promot':59B 'publish':85B 'put':116C 'request':47B,119C 'role':44B,56B,62B,110C,125C 'self':27B 'self-host':26B 'send':114C 'take':43B 'user':5A,11A,57B,68B,100C,131C 'usercontrol':42B,121C 'version':82B 'via':10A 'vulner':93C 'websecurityconfig':40B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111681","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111681","severity":null,"published_at":"2026-10-16T18:17:51+00:00","modified_at":"2026-10-16T22:17:22+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111681:657","url":null,"severity":null,"published_at":"2026-10-24T00:25:43+00:00","modified_at":"2026-10-24T00:25:43+00:00","first_seen_at":"2026-10-24T00:25:43+00:00","fetched_at":"2026-10-24T00:25:43+00:00","note":"VulnCheck advisory + CVE record + finder's HackMD write-up (source review only, no live PoC). No fixed version exists as of 2026-10-24; no X chatter. Sibling CVE-2026-111682 (model-config key leak) same root cause."}],"documents":[{"id":2595,"url":"https://www.vulncheck.com/advisories/efak-through-5.1.0-privilege-escalation-via-api-users-rest-api","title":"VulnCheck: EFAK through 5.1.0 Privilege Escalation via /api/users","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2596,"url":"https://hackmd.io/@hieuPenguinnn/efak-missing-admin-gate-user-management-api","title":"hieuPenguinnn write-up: EFAK missing admin gate (source review, no live PoC)","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":2598,"url":"https://theinjection.dev/items/efak-model-config-api-key-exposure/","title":"theinjection.dev: EFAK model-config key exposure (sibling CVE-2026-111682)","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":2602,"url":"https://www.cve.org/CVERecord?id=CVE-2026-111681","title":"CVE record CVE-2026-111681","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}