Authorization Flaw in EFAK Affects User Management Capabilities

CVE-2026-111681

What is CVE-2026-111681?

EFAK versions up to 5.1.0 contain a missing authorization flaw that allows authenticated users with low privileges to exploit the /api/users endpoints. This vulnerability enables attackers to execute POST, PUT, or DELETE requests to the UserController, granting themselves administrative privileges, creating new administrators, or deleting existing users. As a result, compromised users can gain unauthorized control over managed Kafka clusters, potentially leading to significant security breaches.

References