CVE-2026-111668 — AIHelms through 0.1.25 Missing Authorization in Efficiency Analytics API
AIHelms through 0.1.25 contains a missing authorization vulnerability in apps/api/v1/efficiency.py that allows authenticated low-privileged users to bypass efficiency:read and e…
Published: 2026-10-16 · CVSS: 5.3 · CVSS 4.0
AIHelms through 0.1.25 contains a missing authorization vulnerability in apps/api/v1/efficiency.py that allows authenticated low-privileged users to bypass efficiency:read and efficiency:write permission checks. Attackers can query routes like /cost/detail, /top-users and /budget to read organization-wide AI spend, and can modify suggestion statuses or generate reports.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7