{"id":"CVE-2026-125750","kind":"vulnerability","aliases":["CVE-2026-125750"],"related":[],"title":"Firekylin: editor accounts can read admin secrets through the API","description":"Firekylin through 2.18.1 contains an improper authorization vulnerability that allows editor-role users to read administrator-only secrets because the admin API base guard permits all GET actions. Editors can query options.js for TOTP secrets, push credentials, and cloud storage keys, or user.js for other users' app_key/app_secret to publish posts as administrators via admin/post_push.","summary":"Firekylin, a Node.js blog and content system, lets editor-role users read administrator-only secrets because the admin API permits all GET requests. An attacker with an editor account can pull TOTP secrets, push credentials, cloud storage keys, and other users' app keys, then publish posts as an administrator.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Firekylin","fixed":[],"affected":"<= 2.18.1","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["firekylin","node.js","package","self-hosted"],"not_affected_if":["auth-required","no-editor-accounts"],"how_to_check":"- Firekylin 2.18.1 and earlier 2.x releases are affected; the same code is on master (per the researcher).\n- Review accounts with role type 2 (editor) or 3 (contributor); GET /admin/api/options and /admin/api/user return secrets to any non-commenter, non-admin session.\n- If untrusted editors had access: rotate push_sites appKey/appSecret, every user's app_key/app_secret, the TOTP secret (two_factor_auth), and the password salt/sessions.","fix":"No fixed release as of 2026-11-10. The maintainers' fix is draft PR #976 (unmerged, not deployed). Until a release ships, remove or distrust editor accounts and rotate secrets if untrusted editors existed.","status":"open","published_at":"2026-11-10T16:17:21+00:00","first_seen_at":"2026-11-10T16:22:34+00:00","triaged_at":"2026-11-10T16:23:31+00:00","updated_at":"2026-11-10T16:25:17+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-10T16:23:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Firekylin: editor accounts can read admin secrets through the API","impact":"high","summary":"Firekylin, a Node.js blog and content system, lets editor-role users read administrator-only secrets because the admin API permits all GET requests. An attacker with an editor account can pull TOTP secrets, push credentials, cloud storage keys, and other users' app keys, then publish posts as an administrator.","audience":"businesses","category":"package","nicknames":[],"who_cares":["firekylin","self-hosted","node.js"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker reads secrets and publishes posts as administrator","analyst_note":"Confirm the fixed version and patch status from the NVD entry or the VulnCheck advisory; the sources here give no fixed version.","how_to_check":"- Check the Firekylin version in package.json, `2.18.1` and earlier are affected\n- Review which accounts have the editor role and whether untrusted users hold one\n- unknown","plain_action":"","product_name":"Firekylin","needs_analyst":true,"not_affected_if":["auth-required","no-editor-accounts"],"who_is_affected":"Teams running a self-hosted Firekylin instance with editor-role accounts. The flaw requires an authenticated editor account, so instances where every account is an administrator or where editors are fully trusted carry less practical risk. The sources do not name a fixed version.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000739,"input_tokens":4597,"output_tokens":558,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and patch status from the NVD entry or the VulnCheck advisory; the sources here give no fixed version.","search":"'-125750':13A,16A '-2026':12A,15A '2.18.1':77C 'account':3A,54B 'action':104C 'admin':6A,43B,97C 'admin/post_push':131C 'administr':38B,74B,92C,129C 'administrator-on':37B,91C 'allow':84C 'api':10A,44B,98C 'app':67B,123C 'attack':50B 'author':81C 'base':99C 'blog':27B 'cloud':61B,115C 'contain':78C 'content':29B 'credenti':60B,113C 'cve':11A,14A 'editor':2A,33B,53B,86C,105C 'editor-rol':32B,85C 'firekylin':1A,17A,18B,24B,75C 'get':47B,103C 'guard':100C 'host':23B 'improp':80C 'key':63B,68B,117C 'key/app_secret':124C 'let':31B 'node.js':19B,26B 'options.js':108C 'packag':20B 'permit':45B,101C 'post':71B,127C 'publish':70B,126C 'pull':56B 'push':59B,112C 'queri':107C 'read':5A,36B,90C 'request':48B 'role':34B,87C 'secret':7A,40B,58B,94C,111C 'self':22B 'self-host':21B 'storag':62B,116C 'system':30B 'totp':57B,110C 'user':35B,66B,88C,122C 'user.js':119C 'via':130C 'vulner':82C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Firekylin 2.x (2.18.1 and earlier) in its default configuration, where an administrator has created editor or contributor accounts. A logged-in editor can read the TOTP secret, push credentials and every user's app_key/app_secret through the admin REST API, then post as another author via the push endpoint. Instances with only trusted administrators and no other accounts can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T16:25:17Z","by":"analyst","doc":"https://www.vulncheck.com/advisories/firekylin-through-2.18.1-improper-authorization-via-admin-rest-api-get-actions","run_id":2468}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["firekylin"],"ptokens":["firekylin"],"labels":["firekylin","high","nodejs","package","selfhosted","vendor"],"campaign_type":null,"search_a":"'-125750':13A,16A '-2026':12A,15A 'account':3A 'admin':6A 'api':10A 'cve':11A,14A 'editor':2A 'firekylin':1A,17A 'read':5A 'secret':7A","search_b":"'account':54B 'admin':43B 'administr':38B,74B 'administrator-on':37B 'api':44B 'app':67B 'attack':50B 'blog':27B 'cloud':61B 'content':29B 'credenti':60B 'editor':33B,53B 'editor-rol':32B 'firekylin':18B,24B 'get':47B 'host':23B 'key':63B,68B 'let':31B 'node.js':19B,26B 'packag':20B 'permit':45B 'post':71B 'publish':70B 'pull':56B 'push':59B 'read':36B 'request':48B 'role':34B 'secret':40B,58B 'self':22B 'self-host':21B 'storag':62B 'system':30B 'totp':57B 'user':35B,66B","search_c":"'2.18.1':77C 'action':104C 'admin':97C 'admin/post_push':131C 'administr':92C,129C 'administrator-on':91C 'allow':84C 'api':98C 'app':123C 'author':81C 'base':99C 'cloud':115C 'contain':78C 'credenti':113C 'editor':86C,105C 'editor-rol':85C 'firekylin':75C 'get':103C 'guard':100C 'improp':80C 'key':117C 'key/app_secret':124C 'options.js':108C 'permit':101C 'post':127C 'publish':126C 'push':112C 'queri':107C 'read':90C 'role':87C 'secret':94C,111C 'storag':116C 'totp':110C 'user':88C,122C 'user.js':119C 'via':130C 'vulner':82C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T16:17:21+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125750","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125750","severity":null,"published_at":"2026-11-10T16:17:21+00:00","modified_at":"2026-11-10T16:17:21+00:00","first_seen_at":"2026-11-10T16:22:34+00:00","fetched_at":"2026-11-10T16:22:34+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125750:2468","url":"https://hackmd.io/@hieund/firekylin-admin-api-editor-missing-authz-secret-disclosure","severity":null,"published_at":"2026-11-10T16:25:17+00:00","modified_at":"2026-11-10T16:25:17+00:00","first_seen_at":"2026-11-10T16:25:17+00:00","fetched_at":"2026-11-10T16:25:17+00:00","note":"Read VulnCheck advisory, researcher writeup (hackmd), draft PR #976 (open, unmerged, no release). No fixed version exists; no PoC executed per writeup, no exploitation reported.","cites":["https://hackmd.io/@hieund/firekylin-admin-api-editor-missing-authz-secret-disclosure","https://github.com/firekylin/firekylin/pull/976"]}],"documents":[{"id":116114,"url":"https://www.vulncheck.com/advisories/firekylin-through-2.18.1-improper-authorization-via-admin-rest-api-get-actions","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"},{"id":116252,"url":"https://hackmd.io/@hieund/firekylin-admin-api-editor-missing-authz-secret-disclosure","title":"Firekylin admin REST API missing authorization (researcher writeup)","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":116253,"url":"https://github.com/firekylin/firekylin/pull/976","title":"PR #976 (draft, unmerged): restrict admin API reads and protect configuration secrets","kind":"issue","source":"analyst","publisher":null,"text":"Draft PR from fix/admin-api-secret-access into master, fixes issue #975. Not merged, not deployed, awaiting manual review as of 2026-11-10.","published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}