---
id: "CVE-2026-125750"
page: "https://infrastack.ai/live/CVE-2026-125750"
kind: "vulnerability"
aliases: ["CVE-2026-125750"]
title: "Firekylin: editor accounts can read admin secrets through the API"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Firekylin", "fixed": [], "affected": "<= 2.18.1", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["firekylin", "node.js", "package", "self-hosted"]
not_affected_if: ["auth-required", "no-editor-accounts"]
published_at: "2026-11-10T16:17:21+00:00"
first_seen_at: "2026-11-10T16:22:34+00:00"
updated_at: "2026-11-10T16:25:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125750", "first_seen_at": "2026-11-10T16:22:34+00:00"}, {"source": "analyst", "url": "https://hackmd.io/@hieund/firekylin-admin-api-editor-missing-authz-secret-disclosure", "first_seen_at": "2026-11-10T16:25:17+00:00", "cites": ["https://hackmd.io/@hieund/firekylin-admin-api-editor-missing-authz-secret-disclosure", "https://github.com/firekylin/firekylin/pull/976"]}]
exploit_sources: []
---

# Firekylin: editor accounts can read admin secrets through the API

Link for people: https://infrastack.ai/live/CVE-2026-125750 (this .md is for agents)

Firekylin, a Node.js blog and content system, lets editor-role users read administrator-only secrets because the admin API permits all GET requests. An attacker with an editor account can pull TOTP secrets, push credentials, cloud storage keys, and other users' app keys, then publish posts as an administrator.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Firekylin affected <= 2.18.1 fixed no fixed version listed

## How to check

- Firekylin 2.18.1 and earlier 2.x releases are affected; the same code is on master (per the researcher).
- Review accounts with role type 2 (editor) or 3 (contributor); GET /admin/api/options and /admin/api/user return secrets to any non-commenter, non-admin session.
- If untrusted editors had access: rotate push_sites appKey/appSecret, every user's app_key/app_secret, the TOTP secret (two_factor_auth), and the password salt/sessions.

## Fix

No fixed release as of 2026-11-10. The maintainers' fix is draft PR #976 (unmerged, not deployed). Until a release ships, remove or distrust editor accounts and rotate secrets if untrusted editors existed.

## Timeline

- 2026-11-10T16:22:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125750
- 2026-11-10T16:25:17+00:00 analyst https://hackmd.io/@hieund/firekylin-admin-api-editor-missing-authz-secret-disclosure — Read VulnCheck advisory, researcher writeup (hackmd), draft PR #976 (open, unmerged, no release). No fixed version exists; no PoC executed per writeup, no exploitation reported.

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/firekylin-through-2.18.1-improper-authorization-via-admin-rest-api-get-actions
- [describes] Firekylin admin REST API missing authorization (researcher writeup) https://hackmd.io/@hieund/firekylin-admin-api-editor-missing-authz-secret-disclosure
- [fix] PR #976 (draft, unmerged): restrict admin API reads and protect configuration secrets https://github.com/firekylin/firekylin/pull/976

## From the sources

Firekylin through 2.18.1 contains an improper authorization vulnerability that allows editor-role users to read administrator-only secrets because the admin API base guard permits all GET actions. Editors can query options.js for TOTP secrets, push credentials, and cloud storage keys, or user.js for other users' app_key/app_secret to publish posts as administrators via admin/post_push.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_