EUVD-2026-102973

EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to read LLM provider API keys through the /api/model-config REST API. Attackers with any ROLEUSER account can query /api/model-config/page or /api/model-config/id to retrieve...

PT-2026-116081

EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to read LLM provider API keys through the /api/model-config REST API. Attackers with any ROLE USER account can query /api/model-config/page or /api/model-config/id to retrieve...