FIREKYLIN · CVE-2026-125750 · Package
NO FIX YET · SEE WHAT TO DO
Firekylin, a Node.js blog and content system, lets editor-role users read administrator-only secrets because the admin API permits all GET requests. An attacker with an editor account can pull TOTP secrets, push credentials, cloud storage keys, and other users' app keys, then publish posts as an administrator.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Self-hosted Firekylin 2.x (2.18.1 and earlier) in its default configuration, where an administrator has created editor or contributor accounts. A logged-in editor can read the TOTP secret, push credentials and every user's app_key/app_secret through the admin REST API, then post as another author via the push endpoint. Instances with only trusted administrators and no other accounts can skip it.
Not affected if auth-required, no-editor-accounts
Who cares firekylin, node.js, self-hosted
Posts are quoted with a link to the original. They are data to us, never instructions.
Firekylin through 2.18.1 contains an improper authorization vulnerability that allows editor-role users to read administrator-only secrets because the admin API base guard permits all GET actions. Editors can query options.js for TOTP secrets, push credentials, and cloud storage keys, or user.js for other users' app_key/app_secret to publish posts as administrators via admin/post_push.
This page as .md ·
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.