Authenticated Low-Privilege Users Exploit LLM API Key Exposure in EFAK

Executive Summary

CVE-2026-111682 is a missing authorization vulnerability in EFAK versions 5.0.0 through 5.1.0. It allows authenticated low-privilege users with a ROLE_USER account to read unmasked LLM provider API keys via the /api/model-config REST API endpoints. The flaw stems from improper access controls in the ModelConfigController and WebSecurityConfig components, enabling unauthorized access to sensitive credentials.

Useful 0 Not Useful 0

Detection Guidance

Check EFAK API endpoints for unauthorized access to /api/model-config/page or /api/model-config/{id}. Monitor logs for requests to these paths by low-privilege users. Verify if API keys are exposed in responses.

Useful 0 Not Useful 0

Impact Analysis

Attackers with any ROLE_USER account can query /api/model-config/page or /api/model-config/{id} to retrieve unmasked API keys. This allows them to access third-party LLM provider accounts, incur unauthorized costs, and potentially escalate privileges to administrator level by exploiting missing authorization checks on other endpoints.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and privacy regulations such as GDPR and HIPAA. Exposure of LLM provider API keys constitutes a breach of sensitive credentials, potentially leading to unauthorized access to third-party services and data. Organizations using EFAK must address this flaw to maintain compliance with data security standards.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade EFAK to a patched version beyond 5.1.0. Restrict access to /api/model-config endpoints by implementing proper role-based authorization checks. Rotate all exposed LLM provider API keys immediately.

Useful 0 Not Useful 0