CVE-2026-111681 — EFAK through 5.1.0 Privilege Escalation via /api/users REST API
EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage accounts because the /api/users endpoints lack administ…
Published: 2026-10-16 · CVSS: 8.7 · CVSS 4.0
EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage accounts because the /api/users endpoints lack administrator role checks. Attackers can send POST, PUT, or DELETE requests to UserController to grant themselves ROLE_ADMIN, create administrators, or delete users, gaining control of managed Kafka clusters.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7