CVE-2026-111682

EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to read LLM provider API keys through the /api/model-config REST API. Attackers with any ROLEUSER account can query /api/model-config/page or /api/model-config/id to retrieve...

CVE-2026-111682 EFAK 5.0.0 through 5.1.0 Missing Authorization via /api/model-config Exposes API Keys

EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to read LLM provider API keys through the /api/model-config REST API. Attackers with any ROLEUSER account can query /api/model-config/page or /api/model-config/id to retrieve...

CVE-2026-111682 EFAK 5.0.0 through 5.1.0 Missing Authorization via /api/model-config Exposes API Keys

EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to read LLM provider API keys through the /api/model-config REST API. Attackers with any ROLEUSER account can query /api/model-config/page or /api/model-config/id to retrieve...

CVE-2026-111682

The software EFAK versions 5.0.0 through 5.1.0 is vulnerable to a missing authorization flaw (CWE-862) within the /api/model-config REST API. Authenticated users with low-privilege ROLE_USER accounts can query the /api/model-config/page or /api/model-config/{id} endpoints to retrieve unmasked LLM...

CVE-2026-111682

EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to read LLM provider API keys through the /api/model-config REST API. Attackers with any ROLEUSER account can query /api/model-config/page or /api/model-config/id to retrieve...

CVE-2026-111682 EFAK 5.0.0 through 5.1.0 Missing Authorization via /api/model-config Exposes API Keys

EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to read LLM provider API keys through the /api/model-config REST API. Attackers with any ROLEUSER account can query /api/model-config/page or /api/model-config/id to retrieve...

EUVD-2026-102973

EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to read LLM provider API keys through the /api/model-config REST API. Attackers with any ROLEUSER account can query /api/model-config/page or /api/model-config/id to retrieve...

CVE-2026-111682: Missing Authorization

EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to read LLM provider API keys through the /api/model-config REST API. Attackers with any ROLEUSER account can query /api/model-config/page or /api/model-config/id to retrieve...

PT-2026-116081

EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to read LLM provider API keys through the /api/model-config REST API. Attackers with any ROLE USER account can query /api/model-config/page or /api/model-config/id to retrieve...

Smartloli EFAK authorization issue vulnerability

In versions 5.0.0 to 5.1.0 of smartloli EFAK, there is an authorization issue. This vulnerability stems from a lack of authorization checks. Certified low-privilege users can access the LLM provider’s API keys through the/api/model-config REST API, which may lead to unauthorized access and...