Missing Authorization Vulnerability in EFAK by Smartloli

CVE-2026-111682

What is CVE-2026-111682?

The EFAK product versions 5.0.0 through 5.1.0 exhibit a missing authorization vulnerability that permits authenticated low-privilege users to access sensitive LLM provider API keys through the REST API endpoint /api/model-config. This flaw enables users with any ROLE_USER account to query endpoints such as /api/model-config/page or /api/model-config/{id}, revealing unmasked API keys. Consequently, this may lead to unauthorized access to provider accounts and resultant costs attributed to the exploitation of exposed credentials.

References