EFAK: any logged-in user reads the AI assistant's provider keys
EFAK stores the provider keys its AI assistant uses, and its REST API returns them unmasked to any account that can log in.
· VulnCheck · Research by hieuPenguinnn
CVE-2026-111682 lets any EFAK account with the default ROLE_USER role call /api/model-config and read unmasked LLM provider API keys. The same missing admin gate also lets that account make itself an administrator. No fixed version exists.
01What happened
VulnCheck published CVE-2026-111682 and CVE-2026-111681 for EFAK on October 16, 2026, both recording October 15 as the public disclosure date and both crediting the finder hieuPenguinnn. The finder's HackMD write-up documents a source review of the v5.1.0 tag and states that no requests were sent to a running instance. The GitHub Advisory Database listed the key exposure the same day, unreviewed.
02How it works
EFAK builds one Spring Security filter chain, and that chain asks for the ADMIN role only on page paths such as /users and /config, plus /api/password/**. Every other route falls through to a rule that asks for nothing but a login. The REST controllers behind those admin pages carry no method-level annotation and no interceptor, so ModelConfigController answers any authenticated caller, and its listing handler copies the stored apiKey straight into the response. UserController is open the same way and reads the roles value out of the request body, so a caller can name itself an administrator. CSRF protection is disabled globally, so a logged-in victim's browser can be made to send those writes.
03Who is affected
Self-hosted EFAK is exposed in versions 5.0.0 through 5.1.0, the range both CVE records list, and the project's changelog dates 5.1.0 to September 12, 2026. One ordinary account is enough: the low-privilege ROLE_USER role reaches both APIs, so every user an operator has added can reach them. The keys at risk belong to the models EFAK's AI assistant talks to, which its README lists as OpenAI, Claude and DeepSeek.
04What to do
Treat every provider key stored in an EFAK deployment as exposed and rotate it with the model provider, because no advisory names a patched version. Block outside access to the instance and check the user list for accounts holding the admin role without reason. Operators who patch locally can follow the write-up: put /api/users/**, /api/model-config/** and /api/scheduler/** behind the ADMIN matcher, annotate the admin controllers, verify that a caller may assign the role it asks for instead of trusting the request body, and mask apiKey on every read path.
Sources 7 links, all fetched
- 1vulncheck.comVulnCheck Advisory
- 2hackmd.ioResearcher Write-Up
- 3cveawg.mitre.orgCVE Record
- 4cveawg.mitre.orgAdmin Escalation CVE
- 5github.comGitHub Advisory
- 6github.comModel Config Source
- 7github.comSecurity Config Source