Live › vulnerability › CVE-2026-111682
Go to dashboardEFAK 5.0.0 through 5.1.0 lacks an authorization check on its /api/model-config REST endpoints. Any logged-in ROLE_USER account can retrieve unmasked LLM provider API keys, which lets the attacker use the provider account and run up costs.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
EFAK deployments on versions 5.0.0 through 5.1.0 that store LLM provider keys in the model config are exposed to any user with a ROLE_USER account. Installs with no LLM provider configured, or with only admin accounts, are less exposed. The sources do not say whether managed or hosted installs differ.
No product ranges from the sources yet.
5.0.0 through 5.1.0/api/model-config/page as a non-admin user and see whether unmasked keys are returned5.1.0 (fixed version unknown from sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to read LLM provider API keys through the /api/model-config REST API. Attackers with any ROLE_USER account can query /api/model-config/page or /api/model-config/{id} to retrieve unmasked keys, enabling provider account access and incurred costs.
This page as .md · .json · in your agent: get_signal("CVE-2026-111682")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.