CVE-2026-111681

EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage accounts because the /api/users endpoints lack administrator role checks. Attackers can send POST, PUT, or DELETE requests to UserController to grant themselves ROLEADMIN,...

CVE-2026-111681 EFAK through 5.1.0 Privilege Escalation via /api/users REST API

EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage accounts because the /api/users endpoints lack administrator role checks. Attackers can send POST, PUT, or DELETE requests to UserController to grant themselves ROLEADMIN,...

EUVD-2026-102972

EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage accounts because the /api/users endpoints lack administrator role checks. Attackers can send POST, PUT, or DELETE requests to UserController to grant themselves ROLEADMIN,...

Smartloli EFAK authorization issue vulnerability

SmartLoli EFAK versions 5.1.0 and earlier have an authorization issue. This vulnerability stems from the lack of a role check for the/api/users endpoint. Certified low-privilege users can manage their accounts by sending POST, PUT, or DELETE requests to the UserController. This allows them to gra...

PT-2026-94055

Name of the Vulnerable Software and Affected Versions CMAK versions prior to 3.0.0.7 Description The software fails to apply the scheduled leader election feature toggle to HTML form routes, which allows attackers to bypass the feature gate. By accessing these form endpoints, an attacker can star...

CVE-2026-92778: Protection Mechanism Failure

CMAK through 3.0.0.6 fails to apply the scheduled leader election feature toggle to HTML form routes, allowing attackers to bypass the feature gate. Attackers can access the form endpoints to start and stop the recurring election scheduler, disrupting leadership across managed Kafka clusters...