---
id: "CVE-2026-111681"
kind: "vulnerability"
aliases: ["CVE-2026-111681"]
title: "EFAK: low-privilege users can grant themselves admin via user API"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "EFAK", "fixed": [], "affected": ">= 5.0.0, <= 5.1.0", "ecosystem": "github"}]
ecosystems: []
tags: ["efak", "kafka", "package", "privilege-escalation", "self-hosted"]
not_affected_if: ["auth-required", "managed-hosting"]
published_at: "2026-10-16T18:17:51+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-24T00:25:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111681", "first_seen_at": "2026-10-23T21:57:13+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:25:43+00:00"}]
---

# EFAK: low-privilege users can grant themselves admin via user API

EFAK 5.0.0-5.1.0: /api/users is not on the ADMIN list in WebSecurityConfig, and UserController takes roles from the request body. Any logged-in account, including default ROLE_USER, can promote itself to ROLE_ADMIN, create admins or delete users, and so control the managed Kafka clusters. CSRF is also disabled. No patched version has been published.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:EFAK affected >= 5.0.0, <= 5.1.0 fixed ?

## How to check

Self-hosted EFAK: check the version (5.0.0 to 5.1.0 is affected). Review the user list (the /users page or the user table) for unexpected ROLE_ADMIN accounts. Check that a ROLE_USER session gets 403 on PUT /api/users/{id}; if it succeeds you are exposed. Check access logs for POST/PUT/DELETE on /api/users from non-admin sessions.

## Fix

No fixed version as of 2026-10-24. Restrict network access to EFAK, audit admin accounts, and rotate the provider API keys stored in EFAK (see CVE-2026-111682). Local patch per the write-up: add /api/users/**, /api/model-config/** and /api/scheduler/** to the hasRole(ADMIN) matcher, add @PreAuthorize to the controllers, and stop trusting roles in the request body. Watch smartloli/EFAK releases for a version after 5.1.0.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111681
- 2026-10-24T00:25:43+00:00 analyst — VulnCheck advisory + CVE record + finder's HackMD write-up (source review only, no live PoC). No fixed version exists as of 2026-10-24; no X chatter. Sibling CVE-2026-111682 (model-config key leak) same root cause.

## Documents

- [advisory] VulnCheck: EFAK through 5.1.0 Privilege Escalation via /api/users https://www.vulncheck.com/advisories/efak-through-5.1.0-privilege-escalation-via-api-users-rest-api
- [advisory] CVE record CVE-2026-111681 https://www.cve.org/CVERecord?id=CVE-2026-111681
- [describes] hieuPenguinnn write-up: EFAK missing admin gate (source review, no live PoC) https://hackmd.io/@hieuPenguinnn/efak-missing-admin-gate-user-management-api
- [mentions] theinjection.dev: EFAK model-config key exposure (sibling CVE-2026-111682) https://theinjection.dev/items/efak-model-config-api-key-exposure/

## From the sources

EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage accounts because the /api/users endpoints lack administrator role checks. Attackers can send POST, PUT, or DELETE requests to UserController to grant themselves ROLE_ADMIN, create administrators, or delete users, gaining control of managed Kafka clusters.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_